What are the four steps is used by nmap scanning?

While doing fast scan using F option, which file is used to list the range of ports to scan by nmap?

Which Type of scan sends a packets with no flags set ?

Select the Answer

Steve scans the network for SNMP enabled devices. Which port number Steve should scan?

Why would an attacker want to perform a scan on port 137?

You have initiated an active operating system fingerprinting attempt with nmap against a target system:

[root@ceh NG]# /usr/local/bin/nmap -sT -O 10.0.0.1

Starting nmap 3.28 ( www.insecure.org/nmap/) at 2003-06-18 19:14 IDT

Interesting ports on 10.0.0.1:

(The 1628 ports scanned but not shown below are in state: closed)

Port State Service

21/tcp filtered ftp

22/tcp filtered ssh

25/tcp open smtp

80/tcp open http

135/tcp open loc-srv

139/tcp open netbios-ssn

389/tcp open LDAP

443/tcp open https

465/tcp open smtps

1029/tcp open ms-lsa

1433/tcp open ms-sql-s

2301/tcp open compaqdiag

5555/tcp open freeciv

5800/tcp open vnc-http

5900/tcp open vnc

6000/tcp filtered X11

Remote operating system guess: Windows XP, Windows 2000, NT4 or 95/98/98SE Nmap run completed — 1 IP address (1 host up) scanned in 3.334 seconds

Using its fingerprinting tests nmap is unable to distinguish between different groups of Microsoft based operating systems – Windows XP, Windows 2000, NT4 or 95/98/98SE.

What operating system is the target host running based on the open ports shown above?

You ping a target IP to check if the host is up. You do not get a response. You suspect ICMP is blocked at the firewall. Next you use hping2 tool to ping the target host and you get a response. Why does the host respond to hping2 and not ping packet?

[ceh]# ping 10.2.3.4

PING 10.2.3.4 (10.2.3.4) from 10.2.3.80 : 56(84) bytes of data.

— 10.2.3.4 ping statistics —

3 packets transmitted, 0 packets received, 100% packet loss

[ceh]# ./hping2 -c 4 -n -i 2 10.2.3.4

HPING 10.2.3.4 (eth0 10.2.3.4): NO FLAGS are set, 40 headers +

0 data bytes

len=46 ip=10.2.3.4 flags=RA seq=0 ttl=128 id=54167 win=0 rtt=0.8 ms

len=46 ip=10.2.3.4 flags=RA seq=1 ttl=128 id=54935 win=0 rtt=0.7 ms

len=46 ip=10.2.3.4 flags=RA seq=2 ttl=128 id=55447 win=0 rtt=0.7 ms

len=46 ip=10.2.3.4 flags=RA seq=3 ttl=128 id=55959 win=0 rtt=0.7 ms

— 10.2.3.4 hping statistic —

4 packets tramitted, 4 packets received, 0% packet loss

round-trip min/avg/max = 0.7/0.8/0.8 ms

Which of the following command line switch would you use for OS detection in Nmap?

Which of the following commands runs snort in packet logger mode?

A specific site received 91 ICMP_ECHO packets within 90 minutes from 47 different sites. 77 of the ICMP_ECHO packets had an ICMP ID:39612 and Seq:57072. 13 of the ICMP_ECHO packets had an ICMP ID:0 and Seq:0. What can you infer from this information?