OSCP Network Tunneling and Port Forwarding Quiz

1. In the context of port forwarding, what is 'localhost binding' and why is it important?

Forwarded ports are only accessible locally by default, reducing exposure to other network hosts

It prevents any network access to forwarded ports

It allows all users to access forwarded ports

It encrypts data between local applications

2. When performing network tunneling in an OSCP scenario, what is the most important consideration for maintaining stealth?

Using the highest encryption level available

Minimizing traffic volume and using legitimate protocols to avoid detection by IDS/IPS

Tunneling all traffic regardless of necessity

Using well-known port numbers only

3. In Metasploit, what does the 'route' command do in a meterpreter session?

Displays the target's routing table

Adds routes to allow other Metasploit modules to route traffic through the compromised host

Modifies firewall rules on the target

Establishes encrypted VPN tunnels

4. What is a potential security risk when leaving port forwarding tunnels active on a compromised host?

It provides a persistent backdoor for attackers or lateral movement

It improves network performance

It prevents all malware infections

It automatically updates firewall rules

5. Which protocol is commonly tunneled through HTTP to evade firewall restrictions?

DNS

SSH, RDP, or other protocols using tools like Chisel or httptunnel

ICMP

BGP

6. What is the role of a 'jump host' in network penetration testing?

To block unauthorized access attempts

To serve as an intermediary for accessing restricted internal networks

To monitor and log all network activity

To generate encryption certificates

7. In SSH tunneling, what is the significance of specifying '127.0.0.1' versus '0.0.0.0' as the bind address?

127.0.0.1 allows only local access; 0.0.0.0 allows access from any network interface

They are functionally identical

0.0.0.0 is more secure than 127.0.0.1

127.0.0.1 is only valid on Windows

8. How does 'chisel' simplify HTTP/HTTPS tunneling in penetration tests?

It is a compiled Go binary that creates fast HTTP/HTTPS tunnels and SOCKS proxies

It replaces SSH entirely

It only works on Windows systems

It requires administrative access to function

9. What is 'DNS tunneling' and when might it be used in penetration testing?

Using DNS queries to exfiltrate data or establish covert channels when other ports are blocked

Redirecting all DNS traffic to a specific server

Blocking DNS resolution on a network

Encrypting DNS queries only

10. Which tool allows you to tunnel traffic through a compromised Windows host using meterpreter?

Plink.exe

Netsh interface portproxy

Metasploit's portfwd or route commands

SSH on Windows

11. What does SSH local port forwarding (-L flag) allow you to do?

Forward a local port to a remote service accessible from the SSH server

Forward a remote port to your local machine

Create a SOCKS proxy on the remote server

Establish a direct tunnel without encryption

12. What does the 'GatewayPorts' SSH configuration option control?

Whether remote port forwarding is accessible to other hosts on the network

The maximum number of SSH connections allowed

The encryption strength for SSH keys

The timeout duration for idle connections

13. When using SSH tunneling to bypass a firewall, what is a potential limitation?

SSH tunneling cannot encrypt data

Firewalls may block SSH port 22 or limit outbound SSH connections

SSH is incompatible with Linux systems

Tunneling always requires administrator privileges

14. What is the primary purpose of using 'proxychains' in penetration testing?

To speed up network connections

To route applications through multiple proxies, often for pivoting through restricted networks

To monitor all incoming traffic

To replace firewall rules

15. Which of the following best describes a proxy chain?

Multiple proxies arranged sequentially to route traffic through each one

A single proxy that handles all traffic

A firewall configuration blocking outbound traffic

A load balancer distributing connections

16. In a multi-hop pivot chain, what role does the first compromised host typically play?

It acts as a firewall

It serves as the pivot point or jump host for accessing deeper network segments

It monitors all traffic

It generates encryption keys

17. What is network pivoting?

Using a compromised host to access other systems on its network

Rotating through multiple VPN servers

Changing IP addresses dynamically

Encrypting all traffic with multiple layers

18. Which tool is commonly used to create SOCKS proxies via SSH?

Netcat

Ssh -D (dynamic port forwarding)

Iptables

Nmap

19. What is the primary advantage of using a SOCKS proxy over direct port forwarding?

SOCKS proxies are faster than port forwarding

SOCKS proxies support multiple protocols and allow flexible traffic routing

SOCKS proxies do not require authentication

SOCKS proxies encrypt all traffic by default

20. In the command 'ssh -R 9000:localhost:3306 user@remotehost', what does the -R flag accomplish?

Local port forwarding from port 9000 to remote port 3306

Remote port forwarding exposing local port 3306 on remote port 9000

Recursive tunneling through multiple servers

Dynamic SOCKS proxy creation