TCP view and Superscan

Question 1

Why use port scanning tools?

Answer 1

-Identifies devices on the network
-Identifies operating systems
-Identifies services on a system
-Identifies known network vulnerabilities
-Can be used for both internal and external
evaluation

Question 2

What is TCPview?

Answer 2

A Windows program that will show you detailed listings of all TCP and UDP endpoints on your system

Provides a conveniently presented subset of the Netstat program. Requires Windows 98 or newer

Question 3

What does TCPview show for each connection?

Answer 3

-Process : the owning process (application and process ID)
– Protocol : TCP or UDP
– Local Address
– Remote Address
– State : established, listening, etc.

Question 4

What is superscan?

Answer 4

It is a free connect-based port scanning
software designed to
• detect open TCP and UDP ports
• determine which services are running on those ports,
• run queries such as whois, ping, ICMP traceroute,
and Hostname lookups.

Question 5

What is superscan able to do?

Answer 5

-Scan ports from a range of IP addresses
-Ping remote machines to check for “signs of life”
-Scan for different ports
-Perform host lookup so you don’t need to manually look-up the IP address of the target
system
-Enumerate a network to discover:
– hosts/devices on a network
– scan ports to find well known services

Question 6

What is NMAP?

Answer 6

Port scanning tool

Question 7

What is Zenmap?

Answer 7

The GUI for NMAP

Question 8

How does stealth scan in NMAP work?

Answer 8

Involves sending a SYN packet to request a connection. The host responds with:
– SYN/ACK if the port is open
– RST (Reset) if the port is closed

Question 9

How does TCP connect scan work on NMAP?

Answer 9

Nmap creates temporary connections
– Nmap sends SYN packet to port on target
– if port is open it sends back SYN/ACK packet
– Nmap completes the connection (ACK packet) then disconnects

Question 10

How does NMAP detect a OS?

Answer 10

By determining which ports are open as some OS use particular ports for different OS systems

Question 11

What is Nmap idlescan?

Answer 11

It is where Nmap tries to bypass firewalls by impersonating a trusted host on the network

Question 12

What is Nmap bounce?

Answer 12

Can use other open available hosts as a type of

proxy for different attacks

Question 13

What is Nmap decoy?

Answer 13

Adds extra decoy IP addresses when doing a scan

Question 14

What command will display a Mac address?

Answer 14

ipconfig /all

Question 15

Which ports generally identify a windows operating system?

Answer 15

135, 139, 445, 137, 138

Question 16

Banner grabbing is a way to:

Answer 16

Identify a service running on a specific port number