Commands - Chapter 3, Reconnaissance and Intelligence

Question 1

Which nmap commands grabs banners? What can you identify from this?

Answer 1

nmap -sV

services and their versions

Question 2

What hping parameter is used to set the port to which t send the ping? Set it to port 54

Answer 2

hping -p 54 x.x.x.x

Question 3

describe what the following hping command will do

hping -p 80 -S 192.168.1.100

Answer 3

this will send TCP Syn packets to port 80 on the destination IP

Question 4

what command could help you to find out the OS of IP 192.168.1.1?

Answer 4

nmap -O 192.168.1.1

Question 5

Scan 192.168.1.1 for non-TCP service

Answer 5

nmap -sU 192.168.1.1 (U for UDP)

Question 6

carry out a Connect scan on 192.168.1.1

Answer 6

nmap -sT 192.168.1.1

Question 7

you want a quick and unobtrusive method to scan IP 192.168.1.1, which command do you use?

Answer 7

nmap - sS 192.168.1.1

Question 8

what will the “-o” netstat command switch get you?

Answer 8

process ID’s for each connection.

Question 9

you want to get the ethernet statistics on how many bytes and packets have been sent and received, which netstat switch will give you this?

Answer 9

netstat -e

Question 10

get routing table information from the netstat command

Answer 10

netstat -nr

Question 11

get routing table information from the netstat command

Answer 11

netstat -nr

Question 12

type out the linux command that will get you the DHCP log

Answer 12

journalctl

Question 13

journalctl gives you what?

Answer 13

the linux dhcp logs

Question 14

most configuration files are stored in which directory in linux?

Answer 14

/etc

Question 15

most log files are stored in which directory?

Answer 15

/var/log

Question 16

List the 5 types of Windows event logs

Answer 16

Application logs
security logs
system logs
setup logs
forward events logs

Question 17

which windows event logs will capture resource and rights usage and files being opened, created or deleted?

Answer 17

security logs

Question 18

which windows event log captures login events?

Answer 18

security logs

Question 19

which windows event logs captures events collected from remote computers?

Answer 19

forwarded event logs

Question 20

Why are windows event logs not routinely obtained during reconnaissance?

Answer 20

because they’re stored in a secure location requiring admin system access to get at

Question 21

what activity can obtain the SOA record, the wait time between name changes, minimum TTL for the domain and primary name servers?

Answer 21

DNS zone transfers

Question 22

What linux command can get the email servers of a host as well as its IPv4 and 6 information?

Answer 22

host

Question 23

Which command displays list of active connections and the associated executables? What doesn’t it show?

Answer 23

netstat

doesn’t show UDP connections as they are ‘connectionless’