Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Ethical Hacking > Scanning > Flashcards

Scanning Flashcards

1
Q

What are the goals of scanning?

A
  • Open ports
  • Find live network hosts, firewalls, routers, printers…etc
  • Potential Vulnerabilities
  • OS type used
  • Work out networktopolgy.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is network scanning?

A

A set of procedures, for identifying hosts, ports, and services in a network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the objectives of network scanning?

A
  • To discover live hosts, IP addresses, and open ports of live hosts.
  • To discover OS and system architecture
  • Discover vulnerabilities on live host
  • Discover services running on hosts.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the types of TCP flags?

A
  • URG: data in the packet must proceed immediately
  • RST: resets a connection
  • PSH: sends all buffered data immediately
  • ACK: acknowledges the receipt of the data
  • SYN: initiates a connection between hosts
  • FIN: there will be no further transmisstions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

what is an ARP scan?

A

a Linux-based command-line tool, which scans a subnet of a network for live hosts.
it displays IP adress and MAC adress

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

List the reasons to use ARP scan for host discovery?

A

-Takes the least amount of time
-Least amount of cost
-It identifies hosts that are configured with a local firewall
-

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

ARP scan must be run as__

A

root user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the command used to scan a single host inARP scan?

A

Sudo arp-scan [IP address]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the command used for ARP scan to scan all the network?

A

Sudo arp-scan [IP address] /24

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Explain how does an ARP scan works?

A

send an ARP request for every host on a subnet, and if it receives an ARP reply, then the host is considered “alive”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the command used for ARP scan to scan the local network?

A

sudo arp-scan -l
OR
sudo arp-scan –localnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the nmap options used for ARP host discovery and why?

A
  • sn: limit Nmap to perform only host discovery and not port scanning
  • PR: supports ARP scanning
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the password recovery & network discovery tool for windows called? It is used for ARP host discovery

A

Cain and Abel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the command used for ARP scan to scan local network?

A

Sudo arp-scan -l
OR
Sudo arp-scan –localnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the disadvantage of using ARP for host discovery?

A

It only scans internal/local networks, therefore, it is impractical for scanning systems on a distant network.

how to fix?
We should use ICMP or TCP/UDP discovery for that.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is ICMP?

A
  • Internet Control Message Protocol is an error reporting protocol, mostly used by network administrators for troubleshooting network connections.
  • includes ping and traceroute
  • note: it is rarely used by regular users
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How to check for live systems using ICMP?

A

Send ECHO request and if the host is alive it will send ECHO reply in return.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does the command Traceroute (Linux)/ Tracert (win) do?

A

used to identify the hops between you and your destination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How to set the maximum number of hops to search using Tracert command? using what option?

A

-h
tracert -h [max number] [target]

ex:
tracert -h 2 www.google.com

20
Q

What does the option -PE in nmap do?

A

sends an ICMP ECHO request packet (type 8)

note: must be executed as root or else it will perform TCP pinging.

21
Q

What does the option -PP in nmap do?

A

sends ICMP timestamp message

22
Q

What is Hping3? and what it is used for?

A

a packet crafting tool that allows you to define any combination of flags, on any combination of packet types.

It is now shipped with nmap and called “nping”

used for?

  • port scanning
  • host discovery
  • spoofing (MAC or IP or anything else)
23
Q

what is Superscan4?

A

it is a tool that sends out multiple ICMP ECHO requests in parallel and simply waits and listens for responses.

You can discover hidden hosts behind traditional firewalls using it.

24
Q

Why do pen testers perform TCP/UDP host discovery? and what is the downside?

A

If a web server is blocking ICMP requests (ping), they must have a port open for a client to connect to. Usually, TCP port 80 is open to accept HTTP traffic.

An attacker can probe port 80 and if there is a response it means that the host is alive, however, not all servers are web servers with TCP port 80 open so the attacker must blindly guess and probe several different ports. this takes time and is very noisy which is risky

25
Q

What does the option -Pn in nmap do? and in which situation it would be helpful?

A

-Pn ignores Host dicovery and only does port scanning.

if the target doesn’t have TCP port 80 open or the packets are dropped by the firewall, nmap considers the host as down. but we can use -Pn to query all nmaps port list by telling nmap to do only do a port scan

ex:

sudo nmap -Pn [ip]

26
Q

what does the following command do?

Sudo nmap -Pn –sS -p 80 –open 192.168.1.1

A

Tells nmap to ignore host discovery and only do port scanning and only show results for hosts that have the TCP Port 80 open. And do TCP SYN scan (half open)

27
Q

What are the advantages of port scanning?

A
  • identify TCP/UDP services running on the host
  • identify applications and versions of a service
  • identify type of OS of the target
28
Q

what are the TCP scan types?

A

1- TCP connect scan ( full open scan)
2-TCP SYN SCAN (half open scan)
3-TCP null scan

29
Q

Explain the three types of TCP scans?

(Initial flag set,Open port response, Close port response,Communication with open port, Communication with close, nmap option)

A

see the table in slide 55 :)

30
Q

what does the option -sV in nmap do?

A

version detection

31
Q

what does the option -oN in nmap do?

A

out to a human-readable file

32
Q

what does the option -sU in nmap do?

A

does a UDP scan, very time-consuming in comparison to -sT (TCp connect scan)

33
Q

what does the option -sO in nmap do?

A

Does a protocol scan, where it sends raw IP packet without additional header info

34
Q

what does the option -O in nmap do?

A

Determine operating system type

35
Q

What are the IDS evasion techniques? and also mention their nmap option if there is one

A

1- use fragmented IP packets -f
2-spoof your IP address (decoy) -D
3-use source routing (change source port ) -g [port 80,53,20]
4-connect to proxy servers

36
Q

Which types of TCP scans that packet fragmentation & decoy scan (spoofing) doesn’t work on?

A

1-TCP full scan (-sT)

2-version detection (-sV)

37
Q

Explain the concept of source routing for IDS/firewall evasion?

A

it abuses misconfigured firewalls that allow traffic from certain ports ex: 80 (HTTP), 53(DNS), 20(FTP), therefore changing our source port will allow us to bypass firewall restrictions

38
Q

what is verbose mode?

A

an option available in many OSs that provides additional information as to what the computer is doing and what drivers and software it is loading during startup.

39
Q

how to define port range for hping3?

A

–scan 1-3000 (or any port range you want)

40
Q

what does -S represent?

A

TCP SYN request

41
Q

why would we add the option “–tcp-timestamp” when doing a scan?

A

because there are many firewalls that include a rule to that drops packets that don’t have a timestamp, so this command appends a timestamp to your packet

42
Q

what is banner grabbing?

A

banner grabbing or OS fingerprinting is a method to determine the OS running on a remote target system

43
Q

explain the two types of banner grabbing:

A

1- Active Banner grabbing:
send a specially crafted packet and take a note of the responses, then compare them with a database to determine the OS

note: responses from different OS vary because of the differences in TCP/IP stack implementaction.

2-Passive Banner grabbing:
-from error messages: they provide info ex: os type,
the server type
-sniffing network traffic: analyzing and capturing
packets enable to determine OS
-from page extensions: look for extension in the URL

44
Q

list and explain banner grabbing tools:

A

1- netcat : reads and writes data across network connections using TCP/IP protocol
2-telenet: probe HTTP servers to determine the server field in the HTTP response header

45
Q

list banner grabbing counter measures

A 
1- display false banners to misguide attacker
2- turn off unecessary services 
3- use ServerMask 
4-idk
5- idk see slide 22 in scanning part2
46
Q

Explain ACK probe scanning

A

it is used to check if the system is filtered or not (firewall present or not).

1- send ACK
2- No response –> port filtered ( firewall is present)

1-send ACK
2-RST—–> port not filtered ( no firewall)

47
Q

Explain idle scan of an open port and of an closed port and of a filtered port

A

see slide 29 & 30 in scanning part 2 :)

Ethical Hacking (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions