Overview of Network Scanning

Question 1

IRDP

Answer 1

The ICMP Router Discovery Protocol (IRDP) is a routing protocol that allows a host to discover the IP addresses of active routers on its subnet by listening to router advertisement and solicitation messages on its network. The attacker can add default route entries on a system remotely by spoofing router advertisement messages. Since IRDP does not require any authentication, the target host will prefer the default route defined by the attacker to the default route provided by the DHCP server. The attacker accomplishes this by setting the preference level and the lifetime of the route at high values to ensure that the target hosts will choose it as the preferred route.

Question 2

ARP

Answer 2

Address Resolution Protocol (ARP) is a stateless TCP/IP protocol that maps IP network addresses to the addresses (hardware addresses) used by a data link protocol. Using this protocol, a user can easily obtain the MAC address of any device on a network.

Question 3

DHCP

Answer 3

Dynamic Host Configuration Protocol (DHCP) is a client/server protocol that provides an IP address to an IP host. In addition to the IP address, the DHCP server also provides configuration related information such as the default gateway and subnet mask. When a DHCP client device boots up, it participates in traffic broadcasting.

Question 4

DNS

Answer 4

DNS is the protocol that translates a domain name (into an IP address . The protocol uses DNS tables that contain the domain name and its equivalent IP address stored in a distributed large database.

Question 5

hping3 -1 –p 80

Answer 5

ICMP Ping

Question 6

hping3 –A –p 80

Answer 6

ACK scan on port 80

Question 7

hping3 -2 –p 80

Answer 7

UDP scan on port 80

Question 8

hping3 -8 50-60 –S -V

Answer 8

SYN scan on port 50-60

Question 9

hping3 –F –P –U –p 80

Answer 9

FIN, PUSH and URG scan on port 80

Question 10

hping3 -1 10.0.1.x –rand-dest –I eth0

Answer 10

Scan entire subnet for live host

Question 11

hping3 -9 HTTP –I eth0

Answer 11

Intercept all traffic containing HTTP signature

Question 12

Nmap scripting engine (NSE)

Answer 12

provides scripts that reveal all sorts of useful information from the target web server.
Network discovery
More sophisticated version detection
Vulnerability detection
Backdoor detection
Vulnerability exploitation

Question 13

Ping of death

Answer 13

In a ping of death (PoD) attack, an attacker tries to crash, destabilize, or freeze the target system or service by sending malformed or oversized packets using simple ping command. For instance, the attacker sends a packet that has a size of 65,538 bytes to the target webserver. This size of the packet exceeds the size limit prescribed by RFC 791 IP, which is 65,535 bytes.

Question 14

SYN flooding

Answer 14

In an SYN attack, the attacker sends a large number of SYN requests to the target server (victim) with fake source IP addresses. The attack creates incomplete TCP connections that use up network resources.

Question 15

TCP hijacking

Answer 15

TCP session hijacking allows attackers to take over an active session by bypassing the authentication process.

Question 16

Smurf attack

Answer 16

In a Smurf attack, the attacker spoofs the source IP address with the victim’s IP address and sends a large number of ICMP ECHO request packets to an IP broadcast network. It makes all the hosts on the broadcast network to respond to the received ICMP ECHO requests.

Question 17

While performing a UDP scan of a subnet, you receive an ICMP reply of Code 3/Type 3 for all the pings you have sent out. What is the most likely cause of this

Answer 17

UDP port is closed

Question 18

UDP scan no response

Answer 18

Port is either open | filtered

Question 19

Microsoft baseline security analyzer (MBSA)

Answer 19

Allows administrators to scan local and remote systems for missing security updates as well as common security misconfigurations in Microsoft Windows products.

Question 20

Nmap -sO

Answer 20

IP protocol scan allows you to determine which IP protocols (TCP, ICMP, IGMP, etc.) are supported by target machines. This isn’t technically a port scan, since it cycles through IP protocol numbers rather than TCP or UDP port numbers.

Question 21

Nmap -sT

Answer 21

TCP connect scan is the default TCP scan type when SYN scan is not an option. This is the case when a user does not have raw packet privileges. Instead of writing raw packets as most other scan types do, Nmap asks the underlying operating system to establish a connection with the target machine and port by issuing the connect system call.

Question 22

Nmap -sS

Answer 22

SYN scan is the default scan option used for scanning thousands of ports per second on a fast network not hampered by restrictive firewalls.

Question 23

Nmap -sU

Answer 23

UDP scan works by sending a UDP packet to every targeted port.