Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CEH V11 > MOD3: Scanning Networks > Flashcards

MOD3: Scanning Networks Flashcards

1
Q

Network scanning refers to a set of procedures used for identifying hosts, ports, and services in a network.

True / False.

A

True.
Network scanning is one of the components of intelligence gathering which can be used by an attacker to create a profile of the target organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which one(s) is an objective of network scanning?

a) to discover live hosts, IP address, and open ports of live hosts
b) to discover OSs and system architecture
c) to discover services running on hosts
d) to discover vulnerabilities in live hosts
e) all of the above

A

All of the above.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q 
TCP communication flags:
Data contained in a packet should be processed immediately.
a) FIN
b) ACK
c) PSH
d) SYN
e) RST
f) URG
A

f) URG (urgent)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q 
TCP communication flags:
Resets a connection.
a) FIN
b) ACK
c) PSH
d) SYN
e) RST
f) URG
A

e) RST (reset)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q 
TCP communication flags:
Acknowledges the receipt of a packet.
a) FIN
b) ACK
c) PSH
d) SYN
e) RST
f) URG
A

b) ACK (acknowledgement)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q 
TCP communication flags:
There will be no further transmission.
a) FIN
b) ACK
c) PSH
d) SYN
e) RST
f) URG
A

a) FIN (finish)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q 
TCP communication flags:
Sends all buffered data immediately.
a) FIN
b) ACK
c) PSH
d) SYN
e) RST
f) URG
A

c) PSH

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q 
TCP communication flags:
Initiates a connection between hosts.
a) FIN
b) ACK
c) PSH
d) SYN
e) RST
f) URG
A

d) SYN (synchronize)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which is better, TCP or UDP?

A

TCP is better because packets are more concise.

UDP is not as strict, it’ll just say ‘send another request’.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q 
TCP sequence number of bits.
First 16 bits = \_\_\_\_\_\_\_\_\_\_\_
Next 16 bits = \_\_\_\_\_\_\_\_\_\_\_
Next 32 bits = \_\_\_\_\_\_\_\_\_\_\_
Next 32 bits = \_\_\_\_\_\_\_\_\_\_\_
A

First 16 bits = source port
Next 16 bits = destination port
Next 32 bits = sequence no.
Next 32 bits = ACK (acknowledgement no.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What type of handshake is for TCP session establishing and for TCP session termination?

A

TCP Session Establishment –> 3 way handshake

TCP Session Termination –> 4 way handshake for shut down

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What tool is useful for making payloads?

A

Metasploit.

It also has built in scanners!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How many ports are there per TLP (Transport Layer Protocol?

A

65,536

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How many ports will NMAP scan?

A

NMAP will scan the top 1,000 ports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is RFC73 compliant?

A

It describes how a system should react to illegal requests.
RFC-Compliance code is code that follows the formal requirements for the protocols in the TCP/IP stack is specified in a number ofRFCdocuments published by the Internet Engineering Task Force, aka the IETF.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a Christmas tree packet?

A

A Christmas Tree Attack is a very well known attack that is designed to send a very specifically crafted TCP packet to a device on the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Why would an attacker send TCP probe packets set with an ACK flag to a remote device?

A

To analyze the header information (TTL and WINDOW field) of received RST packets to determine if the port is open or closed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

If the TTL value of the RST packet on a particular port is less than the boundary value of 64, then that port is open.
True/False.

A

True.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

If the window value of the RST packet on a particular port has a non-zero value, then that port is open.
True/False.

A

True.

20
Q

IPV6 scanning increases the IP address size from 32 bit to 128 bits to support more levels of address hierarchy.
True/False.

A

True.

21
Q

What is the benefit of detecting service version from an NMAP scan?
ex. NMAP -sV 10.10.10.10

A
  • attackers obtain info about running services and their versions on a target system
  • determine the vulnerability of a target system to particular exploits
22
Q

What tool can be used to observe the TTL and TCP window size fields?

A

Wireshark.

23
Q 
What is the TTL for the following?
Linux = \_\_\_\_
Windows 95 = \_\_\_\_
Windows 2000 = \_\_\_\_
Windows XP = \_\_\_\_
iOS 12.4 (Cisco Routers) = \_\_\_\_
Solaris 7 = \_\_\_\_
A 
Linux = 64
Windows 95 = 32
Windows 2000 = 128
Windows XP = 128
iOS 12.4 (Cisco Routers) = 255
Solaris 7 = 255
24
Q

In NMAP, the -O option is used to perform what?

A

OS discovery. It will provide OS details of the target machine.

25
Q

In Unicornscan, the OS of the target machine can be identified by observing what?

A

The TTL values in the scan.

26
Q

What are some IP spoofing countermeasures?

A
  • encrypt all network traffic
  • use multiple firewalls
  • don’t rely on IP-based authentication
  • use a random initial sequence number
  • ingress and egress filtering
27
Q

Why would an attacker want to scan the number of hosts in a target network?
ex. nmap –randomize-hosts 10.10.10.10

A

Attackers scan the number of hosts in the target network in random order to scan an intended target that is behind a firewall.

28
Q

Why would attackers want to send bad TCP/UDP checksums to the intended target?
ex. nmap –badsum 10.10.10.10

A

To avoid certain firewall rulesets.

29
Q

What is a proxy server?

A

An application that can serve as an intermediary for connecting with other computers.

30
Q

Why do attackers use proxy servers?

a) to hide the actual source of a scan and evade certain IDS/firewall restrictions
b) to mask the actual source of an attack
c) to remotely access intranets that are normally restricted
d) to interrupt all requests sent by a user and transmit them to a 3rd destination
e) to chain multiple proxy servers to avoid detection
f) all of the above

A

f) all of the above

31
Q

A search in Google will list thousands of free proxy servers.
True/False.

A

True

32
Q

List the 3 types of scanning.

A
  1. Port Scanning: Lists open ports and services
  2. Network Scanning: Lists the active hosts and IP addresses
  3. Vulnerability Scanning: Shows the presence of known weaknesses
33
Q

In NMAP, what does the -PU perform?

A

the -PU performs the UDP ping scan

The UDP ping scan sends UDP packets to the target host; a UDP response means that the host is active

34
Q

In NMAP, what does the -PE perform?

A

the -PE performs the ICMP ECHO ping scan

The ICMP ECHO ping scan involves sending ICMP ECHO requests to a host. If the target host is alive, it will return an ICMP ECHO reply.

35
Q

In NMAP, what does the ICMP ECHO ping sweep do?

A

The ICMP ECHO ping sweep is used to determine the live hosts from a range of IP addresses by sending ICMP ECHO requests to multiple hosts. If a host is alive, it will return an ICMP ECHO reply.

36
Q

In NMAP, what does the -O perform?

A

-O performs the OS discovery.

37
Q

In NMAP, what does the -A perform?

A

-A enables aggressive scan.

The aggressive scan option supports OS detection (-O), version scanning (-sV), script scanning (-sC), and traceroute (–traceroute). You should not use -A against target networks without permission.

38
Q

In NMAP, what does the -sV perform?

A

-sV detects service versions

Service version detection helps you to obtain information about the running services and their versions on a target system. Obtaining an accurate service version number allows you to determine which exploits the target system is vulnerable to.

39
Q

In NMAP, what does the -sU perform?

A

-sU is for performing UDP scan

The UDP scan uses UDP protocol instead of the TCP. There is no three-way handshake for the UDP scan. It sends UDP packets to the target host; no response means that the port is open. If the port is closed, an ICMP port unreachable message is received.

40
Q

In NMAP, what does the -sA perform?

A

-sA is for performing the ACK flag probe scan.

The ACK flag probe scan sends an ACK probe packet with a random sequence number; no response implies that the port is filtered (stateful firewall is present), and an RST response means that the port is not filtered.

41
Q

In NMAP, what does the -sM perform?

A

-sM is for performing the TCP Maimon scan

In the TCP Maimon scan, a FIN/ACK probe is sent to the target; if there is no response, then the port is Open|Filtered, but if the RST packet is sent as a response, then the port is closed.

42
Q

In NMAP, what does the -sX perform?

A

-sX is for xmas scan

Xmas scan sends a TCP frame to a target system with FIN, URG, and PUSH flags set. If the target has opened the port, then you will receive no response from the target system. If the target has closed the port, then you will receive a target system reply with an RST.

43
Q

In NMAP, what does the -sS perform?

A

-sS is for performing stealth scan/TCP half-open scan

The stealth scan involves resetting the TCP connection between the client and server abruptly before completion of three-way handshake signals, and hence leaving the connection half-open. This scanning technique can be used to bypass firewall rules, logging mechanisms, and hide under network traffic.

44
Q

In NMAP, TCP connect scan completes a three-way handshake with the target machine.

How is this handshake completed and what would the client need to send to end the connection?

A

In the TCP three-way handshake, the client sends a SYN packet, which the recipient acknowledges with the SYN+ACK packet. In turn, the client acknowledges the SYN+ACK packet with an ACK packet to complete the connection.

Once the handshake is completed, the client sends an RST packet to end the connection.

45
Q

In NMAP, what does -sT perform?

A

-sT: performs the TCP connect/full open scan

46
Q

In NMAP, what does -v perform?

A

-v: enables the verbose output (include all hosts and ports in the output).

CEH V11 (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions