Deck 1 Flashcards
What should you do if a script is missing in the local scripts directory?
You can fix this by running ‘sudo apt update && sudo apt install nmap’ or by manually downloading the script from Nmap and updating the script.db file.
What command can you run to manually install a missing NSE script?
You can run ‘sudo wget -O /usr/share/nmap/scripts/.nse https://svn.nmap.org/nmap/scripts/.nse’ to download and install the script.
What command should you run after manually installing an NSE script to update the script.db file?
You should run ‘nmap –script-updatedb’ to update the script.db file after manually installing a script.
Where does Nmap store its scripts on Linux?
/usr/share/nmap/scripts
What is the purpose of the /usr/share/nmap/scripts/script.db file?
To search for installed scripts in Nmap.
Where can you find a list of all official scripts for Nmap?
On the Nmap website.
What is the content stored in the script.db file?
Filenames and categories for each available script.
What is the command to activate NSE scripts from the vuln category?
To activate NSE scripts from the vuln category, the command is –script=vuln.
What is the command to run multiple scripts simultaneously?
To run multiple scripts simultaneously, the command is –script=,.
How can arguments be given to NSE scripts using the Nmap switch?
Arguments can be given to NSE scripts using the –script-args Nmap switch.
How can the built-in help menu for Nmap scripts be accessed?
The built-in help menu for Nmap scripts can be accessed using the command nmap –script-help .
What language are NSE Scripts written in?
NSE Scripts are written in the Lua programming language.
What are some categories of NSE Scripts?
Some categories of NSE Scripts include safe, intrusive, vuln, exploit, auth, brute, and discovery.
What can NSE Scripts be used for?
NSE Scripts can be used for scanning for vulnerabilities, automating exploits, reconnaissance, bypassing authentication, and querying running services for further information about the network.
What is the purpose of using a ping sweep with Nmap?
The purpose of using a ping sweep with Nmap is to obtain a map of the network structure by identifying active hosts based on ICMP echo responses.
What does the -sn switch do in Nmap?
The -sn switch in Nmap tells it not to scan any ports and rely primarily on ICMP echo packets to identify targets during a ping sweep.
What additional packets does the -sn switch cause Nmap to send during a ping sweep?
In addition to ICMP echo requests, the -sn switch causes Nmap to send a TCP SYN packet to port 443 and a TCP ACK (or TCP SYN if not run as root) packet to port 80 of the target during a ping sweep.
How can you specify IP ranges when performing a ping sweep with Nmap?
You can specify IP ranges using either a hyphen (-) or CIDR notation when performing a ping sweep with Nmap.
What are NULL scans used for?
NULL scans are used to send TCP requests with no flags set at all.
What is the expected behavior if a port is protected by a firewall during a NULL, FIN, or Xmas scan?
If a port is protected by a firewall during a NULL, FIN, or Xmas scan, the scan will identify the port as open|filtered, closed, or filtered.
What is the purpose of FIN scans?
FIN scans send a request with the FIN flag and expect a RST response if the port is closed.
What is the reason for most modern IDS solutions being savvy to NULL, FIN, and Xmas scan types?
Most modern IDS solutions are savvy to NULL, FIN, and Xmas scan types because they are designed to detect these scan techniques and prevent firewall evasion.
What is the expected response from network hosts for closed ports according to RFC 793?
According to RFC 793, network hosts should respond to malformed packets with a RST TCP packet for closed ports.
Why are Xmas scans called Xmas scans?
Xmas scans are called Xmas scans because the flags it sets (PSH, URG, and FIN) give it the appearance of a blinking Christmas tree when viewed as a packet capture in Wireshark.
What is the main characteristic of UDP connections?
UDP connections are stateless and do not require a handshake.
What is one reason why UDP scans tend to be slower compared to TCP scans?
UDP scans tend to be slower due to the difficulty in identifying whether a UDP port is actually open.
What is the switch for performing a UDP scan in Nmap?
The switch for performing a UDP scan in Nmap is -sU.
What is a good practice when running an Nmap scan with UDP?
A good practice is to run an Nmap scan with –top-ports enabled to scan the top commonly used UDP ports.
What type of requests does Nmap usually send when scanning UDP ports?
Nmap usually sends completely empty requests (raw UDP packets) when scanning UDP ports.
How does Nmap identify an open UDP port?
When a packet is sent to an open UDP port, there should be no response, and Nmap refers to the port as being open|filtered.
What are the advantages of SYN scans over TCP Connect scans?
SYN scans are faster than TCP Connect scans and require sudo permissions to work correctly in Linux.
What does it mean if a port is considered filtered?
If a port is considered filtered, it means that it is open but hidden behind a firewall, and the firewall is configured to drop incoming packets.
How can a firewall be configured to respond with a RST TCP packet?
A firewall can be configured to respond with a RST TCP packet by using commands such as ‘iptables -I INPUT -p tcp –dport -j REJECT –reject-with tcp-reset’ in IPtables for Linux.
What does it mean when Nmap sends a TCP SYN request and receives nothing back?
When Nmap sends a TCP SYN request and receives nothing back, it indicates that the port is being protected by a firewall and the port is considered to be filtered.
What makes it difficult to get an accurate reading of the target when a firewall is configured to respond with a RST TCP packet?
When a firewall is configured to respond with a RST TCP packet, it can make it extremely difficult, if not impossible, to get an accurate reading of the target(s) using Nmap.
How does Nmap determine if a port is closed?
Nmap sends a TCP request with the SYN flag set to the closed port, and if the server responds with a TCP packet with the RST flag set, Nmap establishes that the port is closed.
What happens when Nmap sends a TCP request to an open port?
If Nmap sends a TCP request to an open port, the target server will respond with a TCP packet with the SYN/ACK flags set.
How does Nmap mark a port as open?
Nmap marks a port as open when it receives a TCP packet with the SYN/ACK flags set in response to its TCP request.
What is the purpose of the TCP packet with the RST flag set?
The TCP packet with the RST (Reset) flag set is sent by the target server to indicate that the connection does not exist and that the port is closed.
What is the purpose of a TCP Connect scan?
The purpose of a TCP Connect scan is to determine whether a TCP port on a target server is open or closed.
How does a TCP Connect scan work?
A TCP Connect scan works by performing the three-way handshake with each target port, attempting to establish a connection and determine if the service is open or closed.
What are the three stages of the TCP three-way handshake?
The three stages of the TCP three-way handshake are: 1) Sending a TCP request with the SYN flag set, 2) Acknowledging the packet with a TCP response containing the SYN and ACK flags, 3) Sending a TCP request with the ACK flag set to complete the handshake.
What are the three basic scan types when port scanning with Nmap?
The three basic scan types when port scanning with Nmap are TCP Connect Scans (-sT), SYN ‘Half-open’ Scans (-sS), and UDP Scans (-sU).
What are some less common port scan types covered in the content?
Some less common port scan types covered in the content are TCP Null Scans (-sN), TCP FIN Scans (-sF), and TCP Xmas Scans (-sX).
What is one notable difference between UDP scans and the other scan types discussed?
One notable difference between UDP scans and the other scan types discussed is that UDP scans work differently compared to TCP Connect Scans, SYN ‘Half-open’ Scans, TCP Null Scans,
TCP FIN Scans, and TCP Xmas Scans.
How can you access the help menu for nmap?
By typing nmap -h in the terminal command line.
What are switches in nmap?
Command arguments which tell a program to do different things.
What tool is commonly used for port scanning?
nmap
What is the purpose of port scanning?
The purpose of port scanning is to determine which ports on a target system are open, closed, or filtered by a firewall.
What is the purpose of performing a port scan before attacking a target?
To determine which ports are open on the target server.
What is the industry standard tool for port scanning?
The industry standard tool for port scanning is Nmap.
What is the standard port for HTTP Webservice?
Port 80.
What makes Nmap a powerful tool for port scanning?
Nmap is a powerful tool for port scanning because it has extensive functionality and a scripting engine that can be used to scan for vulnerabilities and perform exploits.
Why is proper enumeration important before attempting exploitation?
Proper enumeration is important before attempting exploitation because it provides knowledge about the target system or network, allowing for better informed exploitation attempts.
What is the purpose of port scanning in the reconnaissance phase of hacking?
The purpose of port scanning is to identify which services are running on the target system or network, providing a map of the ‘landscape’ to be attacked.
