312-50V10 · Question #343
A security engineer is attempting to map a company's internal network. The engineer enters in the following NMAP command: NMAP -n -sS -P0 -p 80 ... What type of scan is this?
The correct answer is C. Stealth scan. The NMAP -sS flag performs a TCP SYN scan, known as a stealth scan because it never completes the three-way handshake.
Question
A security engineer is attempting to map a company's internal network. The engineer enters in the following NMAP command:
NMAP -n -sS -P0 -p 80 ... What type of scan is this?
Options
- AQuick scan
- BIntense scan
- CStealth scan
- DComprehensive scan
How the community answered
(40 responses)- A3% (1)
- B8% (3)
- C88% (35)
- D3% (1)
Why each option
The NMAP -sS flag performs a TCP SYN scan, known as a stealth scan because it never completes the three-way handshake.
A quick scan uses the -F flag to scan a reduced set of ports, which is not present in this command.
An intense scan uses -T4 -A to enable OS detection, version scanning, and script scanning, none of which are specified here.
The -sS flag instructs NMAP to send a SYN packet and, upon receiving a SYN-ACK, respond with RST instead of completing the TCP handshake. This half-open technique avoids creating a full connection that would appear in application logs, making detection harder and earning it the name stealth scan.
A comprehensive scan typically combines -sS -sU -T4 -A -v across a broad port range, far beyond the single-port scan shown here.
Concept tested: NMAP TCP SYN stealth scan technique
Source: https://nmap.org/book/man-port-scanning-techniques.html
Topics
Community Discussion
No community discussion yet for this question.