2.3 Information Gathering and Vulnerability Scanning

Question 1

Why can Address Resolution Protocol (ARP) traffic be useful?

Answer 1

One reason to gather ARP traffic is to discover hosts on a network. Then it is possible to launch an ARP poisoning attack, which deliberately maps an incorrect MAC address to a correct IP address, which poisons the ARP cache in order to redirect traffic for malicious purposes.

Question 2

What is the difference between passive and active OS fingerprinting?

Answer 2

Passive OS fingerprinting gathers network traffic using a packet sniffer such as Wireshark. This is useful for avoiding detection by a firewall or IDS.
Active OS fingerprinting uses the nmap -sV command and thus actively sends out probes and analyzes the returned packets.