4.1: Given a scenario, use the appropriate tool to assess organizational security.

Question 1

Network Reconnaissance and Discovery

Answer 1

tracert/traceroute
nslookup/dig
ipconfig/ifconfig
nmap
ping/pathping

Question 2

hping

Answer 2

Hping is a TCP/IP packet creation tool that allows a user to craft raw IP, TCP, UDP, and ICMP packets from scratch. This tool provides a means of performing a wide range of network operations;

Question 3

EXAM TIP

Answer 3

The netstat command is useful for viewing all listening ports on a computer and determining which connections are active.

Question 4

netcat

Answer 4

The netcat utility is the tool of choice in Linux for reading from and writing to network connections using TCP or UDP. Like all Linux command-line utilities, it is designed for scripts and automation.

Question 5

theHarvester

Answer 5

heHarvester is a Python-based program designed to assist penetration testers in the gathering of information during the reconnaissance portion of a penetration test. This is a useful tool for exploring what is publicly available about your organization on the Web, and it can provide information on employees, e-mails, and subdomains using different public sources such as search engines

Question 6

Tcpreplay

Answer 6

Tcpreplay is the name for both a tool and a suite of tools. As a suite, tcpreplay is a group of free, open source utilities for editing and replaying previously captured network traffic.

Question 7

memdump

Answer 7

Linux has a utility program called memory dumper, or memdump. This program dumps system memory to the standard output stream, skipping over any holes in memory maps

Question 8

WinHex

Answer 8

WinHex is a hexadecimal file editor. This tool is very useful in forensically investigating files, and it provides a whole host of forensic functions such as the ability to read almost any file, display contents of the file, convert between character sets and encoding, perform hash verification functions, and compare files.