Reconnaissance, nmap scan types, banner grabbing, enumeration of SMB, SNMP, LDAP and DNS, and vulnerability analysis.
40 cards · basic cards · AI-written, checked twice. Edit anything.
- What is passive footprinting?
Show answer
Gathering publicly available information without directly contacting the target- What is active footprinting?
Show answer
Directly interacting with the target to gather information- What is banner grabbing?
Show answer
Retrieving service version and OS info by connecting to open ports- Which nmap scan uses a complete TCP three-way handshake?
Show answer
TCP Connect scan (-sT)- Which nmap scan leaves minimal logging on the target?
Show answer
TCP SYN scan (-sS), also called half-open scan- What nmap parameter enables OS detection?
Show answer
-O- What nmap parameter enables service version detection?
Show answer
-sV- What are the four port states nmap can report?
Show answer
Open, closed, filtered, unfiltered- What is the difference between filtered and closed ports?
Show answer
Filtered: firewall blocks probes. Closed: host responds the port is unused.- What is an ACK scan (-sA) used to determine?
Show answer
Mapping firewall rules and identifying filtered ports- What is a FIN scan (-sF)?
Show answer
Sends packets with FIN flag set; probes for open ports based on RFC compliance- What is an Xmas scan (-sX)?
Show answer
Sends packets with FIN, PSH and URG flags set; stealthier than SYN scan- What is a Null scan (-sN)?
Show answer
Sends TCP packets with no flags set to probe for open ports- What is an Idle scan (-sI)?
Show answer
Uses a zombie host to scan the target without revealing attacker's IP- What protocol and port does SNMP use?
Show answer
UDP on port 161
FlashKeepers