MODULE 3: Scanning Networks Flashcards
(35 cards)
What is the go to tool for extracting info such as live hosts on network, open ports, services, type of packet filters, firewalls, and OS/Versions used?
NMAP
NMAP Switches:
Match the switch to its meaning/use.
- -s output
- -p Fast Scan (top 100 ports)
- -O port
- -o scan
- -T Operating System
- -F Time
- -oX XML Output to the file “xml.file”
- -s 4. output
- -p 6. Fast Scan (top 100 ports)
- -O 2. port
- -o 1. scan
- -T 3. Operating System
- -F 5. Time
- -oX 7. XML Output to the file “xml.file”
Match the nmap scan to its description.
- -sT XMAS scan, uses the Fin, Urg, Psh flags
- -sS TCP Scan, full connect
- -sX SYN scan, stealth scan, “half-open”
- -sn idle scan
- -sI ping scan
- -sT 3. XMAS scan, uses the Fin, Urg, Psh flags
- -sS 1. TCP Scan, full connect
- -sX 2. SYN scan, stealth scan, half-open connection
- -sn 5. idle scan
- -sI 4. ping scan
If a hacker’s objective was to port scan a target network, what would they first do to cut down on time and their footprint in the network by making sure hosts are alive first?
Ping Sweep
What type of privileges does nmap require to fully function correctly?
root/sudo
nmap -sV host.domain.com -p 80
is an example of ______ ________?
banner grabbing
What command line network scanning and packet crafting tool for TCP/IP can be used for network security auditing, firewall testing, ect.?
Hping2/3
What type of hping2/3 scan can a hacker use to spoof the source IP address and source ports?
ACK scan
ex: hping3 -a 10.10.10.25 -p 80
hping2 -1 host.domain.com
is an example of:
an ICMP scan on a remote computer using hping2 syntax
What type of scan sends ARP request probes to target hosts where receiving an ARP response back indicates that the host is alive?
ARP Ping Scan
In an IDLE IPID scan what indicates an open port?
a. target sends SYN/ACK, zombie responds with RST, and IPID increases by 2
b. target sends RST, no response from zombie, IPID increases by 1
a. target sends SYN/ACK, zombie responds with RST, and IPID increases by 2
If an attacker's computer sends an IPID of 31400 to a zombie (Idle Scanning) computer on an open port, what will be the response? A. 31400 B. 31402 C. The zombie will not send a response D. 31401
B. 31402
TCP SYN Flood attack uses the three-way handshake mechanism.
1. An attacker at system A sends a SYN packet to victim at system B.
2. System B sends a SYN/ACK packet to victim A.
3. As a normal three-way handshake mechanism system A should send an ACK packet to system B, however, system A does not send an ACK packet to system B. In this case client B is waiting for an ACK packet from client A.
This status of client B is called _________________
A. “half-closed”
B. “half open”
C. “full-open”
D. “xmas-open”
B. “half open”
What type of port scan is shown below?
Scan directed at open port:
Client Server
192.5.2.92:4079—————–FIN——————-192.5.2.110:23
192.5.2.92:4079 <——–NO RESPONSE——- 192.5.2.110:23
Scan directed at closed port:
Client Server
192.5.2.92:4079—————–FIN——————-192.5.2.110:23
192.5.2.92:4079 <———–RST/ACK————- 192.5.2.110:23
A. Idle Scan
B. FIN Scan
C. XMAS Scan
D. Windows Scan
B. FIN Scan
An attacker is using nmap to do a ping sweep and a port scanning in a subnet of 254 addresses. In which order should he perform these steps?
A. The sequence does not matter. Both steps have to be performed against all hosts.
B. First the port scan to identify interesting services and then the ping sweep to find hosts responding to icmp echo requests.
C. First the ping sweep to identify live hosts and then the port scan on the live hosts. This way he saves time.
D. The port scan alone is adequate. This way he saves time.
C. First the ping sweep to identify live hosts and then the port scan on the live hosts. This way he saves time.
To maintain compliance with regulatory requirements, a security
audit of the systems on a network must be performed to
determine their compliance with security policies. Which one of
the following tools would most likely be used in such an audit?
A. Vulnerability scanner
B. Protocol analyzer
C. Port scanner
D. Intrusion detection system
A. Vulnerability scanner
The following is part of a log file taken from the machine on the network with the IP address of 192.168.1.106:
Mar 13 17:30:15 Port:20 Source:192.168.1.103 Destination:192.168.1.106 TCP
Mar 13 17:30:17 Port:21 Source:192.168.1.103 Destination:192.168.1.106 TCP
Mar 13 17:30:19 Port:22 Source:192.168.1.103 Destination:192.168.1.106 TCP
Mar 13 17:30:21 Port:23 Source:192.168.1.103 Destination:192.168.1.106 TCP
Mar 13 17:30:22 Port:25 Source:192.168.1.103 Destination:192.168.1.106 TCP
Mar 13 17:30:23 Port:80 Source:192.168.1.103 Destination:192.168.1.106 TCP
Mar 13 17:30:30 Port:443 Source:192.168.1.103 Destination:192.168.1.106 TCP
What type of activity has been logged?
A. Port scan targeting 192.168.1.103
B. Teardrop attack targeting 192.168.1.106
C. Denial of service attack targeting 192.168.1.103
D. Port scan targeting 192.168.1.106
D. Port scan targeting 192.168.1.106
NMAP -sn 192.168.11.200-215
The NMAP command above performs which of the following? A. A ping scan B. A trace sweep C. An operating system detect D. A port scan
A. A ping scan
You have successfully comprised a server having an IP address of 10.10.0.5. You would like to enumerate all machines in the same network quickly. What is the best nmap command you will use?
A. nmap -T4 -F 10.10.0.0/24
B. nmap -T4 -r 10.10.1.0/24
C. nmap -T4 -O 10.10.0.0/24
D. nmap -T4 -q 10.10.0.0/24
A. nmap -T4 -F 10.10.0.0/24
During a UDP scan, does the target system respond with a message when the port is open?
No, the target system will not respond with any message when the target system’s port is open
What is the term for the method used to determine the operating system running on a remote target system? (passive and active)
OS Discovery/Banner Grabbing
What type of banner grabbing involves sending specially crafted packets to a target, noting responses, then comparing with a database in order to determine OS?
Active Banner Grabbing
What type of banner grabbing ascertains OS type by banner grabbing from error messages, sniffing network traffic, and banner grabbing from page extensions?
Passive banner grabbing
A remote intruder wants to take inventory of a network so exploits can be researched. The intruder is looking for information about software versions on the network. Which of the following techniques is the intruder using?
A. Banner grabbing
B. Port scanning
C. Packet sniffing
D. Virus scanning
A. Banner grabbing
