Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

cybersecurity > NMAP > Flashcards

NMAP Flashcards

1
Q

Port Scan Type: Full Connect

A

AKA Tcp Connect or Full Open Scan. complete 3-way handshake torn down with RST. Easist to detect but most reliable. Open port respond with SYN\ACK– closed with RST

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Port Scan Type: Stealth

A

AKA SYN scan or Half-open scan. Only SYN are sent. Open gets a syn/ack closed gets rst. Better at hiding scan and bypassing firewalls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Port Scan Type: Inverse TCP Flag

A

AKA Null or FIN scan Uses FIN URG or PSH flag or none at all. Open port gets no response. Closed gets RST/ACK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Port Scan Type: XMAS

A

XMAS URG, PSH FIN, flags are on. Open gets no response. closed gets RST/Ack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Port Scan Type: ACK Flag Probe

A

Probe with ACK. Look at return RST packet if TTL is less than 64 or the WINDOW size has anything other than 0 in it it is open. Also can be used to check filtering if there is no response there is a stateful firewall between attacker and host if a RST comes back there is not

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Nmap switch: -sA

A

ACK scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Nmap switch: -sF

A

FIN Scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Nmap switch: -sI

A

IDLE Scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Nmap switch: -sL

A

DNS or list scan.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Nmap switch: -sN

A

Null scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Nmap switch: -sO

A

Protocol Scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Nmap switch: -sP

A

Ping scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Nmap switch: -sR

A

RPC Scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Nmap switch: -sS

A

Syn scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Nmap switch: -sT

A

TCP full connect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Nmap switch: -sW

A

Window scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Nmap switch: -sX

A

Xmas Scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Nmap switch: -PI -PE -PM -PP

A

ICMP ping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Nmap switch: -Po -PN

A

no ping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Nmap switch: -PS

A

Syn Ping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Nmap switch: -PT

A

TCP ping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Nmap switch: -oN

A

Normal output

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Nmap switch: -oX

A

XML output

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Nmap switch: -oG

A

GREPable output

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Nmap switch: -oA
All formats including script kiddie
26
Nmap switch: -O
OS finger printing
27
Nmap switch: -A
aggressive scan includes version scan, script, protocol, and traceroute
28
Nmap switch: -F
Fast limited ports only 100
29
Nmap switch: -P
port range
30
Nmap switch: -iL
input from list
31
Nmap switch: -PR
ARP ping
32
Nmap switch: -f
Fragment package
33
Nmap switch: -T0
Serial slowest Paranoid 5 min between probes
34
Nmap switch: -T1
serial slowest Sneaky 15 seconds between probes
35
Nmap switch: -T2
Serial slow normal speed Polite .4 sec (400 mil seconds) between probes
36
Nmap switch:-T3
Parallel normal speed default (max delay of 1 sec )
37
Nmap switch:-T4
parallel fast scan aggressive max delay of 10 milsec)
38
nmap: -T5
insane mode caps and delay at 5ms
39
Nmap switch: -R -n
Dns resolution for everything and no DNS resolution for anything
40
Nmap switch: -D RND:10.0.0.0
creates decoy random ips with attackers ip interspersed as well
41
nmap --script http-trace -p80 localhost
detects server that uses trace
42
nmap --script http-google-email
lists email accounts
43
nmap --script hostmap-*
discovers virtual host the * is replaced with DB you are querying.
44
nmap --script http-enum -p80
enumerates common web applications
45
nmap -p 80 -- script http-robots.txt
grabs robots.txt file
46
Full Open Scan. complete 3-way handshake torn down with RST. Easist to detect but most reliable. Open port respond with SYN\ACK-- closed with RST
Port Scan Type: Full Connect
47
AKA SYN scan or Half-open scan. Only SYN are sent. Open gets a syn/ack closed gets rst. Better at hiding scan and bypassing firewalls
Port Scan Type: Stealth
48
AKA Null or FIN scan Uses FIN URG or PSH flag or none at all. Open port gets no response. Closed gets RST/ACK
Port Scan Type: Inverse TCP Flag
49
URG, PSH FIN, flags are on. Open gets no response. closed gets RST/Ack
Port Scan Type: XMAS
50
Look at return RST packet if TTL is less than 64 or the WINDOW size has anything other than 0 in it it is open. Also can be used to check filtering if there is no response there is a stateful firewall between attacker and host if a RST comes back there is not
Port Scan Type: ACK Flag Probe
51
ACK scan
Nmap switch: -sA
52
FIN Scan
Nmap switch: -sF
53
IDLE Scan
Nmap switch: -sI
54
DNS or list scan.
Nmap switch: -sL
55
Null scan
Nmap switch: -sN
56
Protocol Scan
Nmap switch: -sO
57
Ping scan
Nmap switch: -sP
58
RPC Scan
Nmap switch: -sR
59
Syn scan
Nmap switch: -sS
60
TCP full connect
Nmap switch: -sT
61
Window scan
Nmap switch: -sW
62
Xmas Scan
Nmap switch: -sX
63
ICMP ping
Nmap switch: -PI -PE -PM -PP
64
no ping
Nmap switch: -Po -PN
65
Syn Ping
Nmap switch: -PS
66
TCP ping
Nmap switch: -PT
67
Normal output
Nmap switch: -oN
68
XML output
Nmap switch: -oX
69
GREPable output
Nmap switch: -oG
70
All formats including script kiddie
Nmap switch: -oA
71
OS finger printing
Nmap switch: -O
72
scan includes version scan, script, protocol, and traceroute
Nmap switch: -A
73
Fast limited ports only 100
Nmap switch: -F
74
port range
Nmap switch: -P
75
input from list
Nmap switch: -iL
76
ARP ping
Nmap switch: -PR
77
Fragment package
Nmap switch: -f
78
Serial slowest Paranoid 5 min between probes
Nmap switch: -T0
79
serial slowest Sneaky 15 seconds between probes
Nmap switch: -T1
80
Serial slow normal speed Polite .4 sec (400 mil seconds) between probes
Nmap switch: -T2
81
Parallel normal speed default (max delay of 1 sec )
Nmap switch:-T3
82
parallel fast scan aggressive max delay of 10 milsec
Nmap switch:-T4
83
insane mode caps and delay at 5ms
nmap: -T5
84
Dns resolution for everything and no DNS resolution for anything
Nmap switch: -R -n
85
creates decoy random ips with attackers ip interspersed as well
Nmap switch: -D RND:10.0.0.0
86
detects server that uses trace
nmap --script http-trace -p80 localhost
87
lists email accounts
nmap --script http-google-email
88
discovers virtual host the * is replaced with DB you are querying.
nmap --script hostmap-*
89
enumerates common web applications
nmap --script http-enum -p80
90
grabs robots.txt file
nmap --script http-robots.txt
91
Nmap switch: -sC
Script Scan

cybersecurity (22 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions