nerdexam
EC-Council

312-50V10 · Question #748

While scanning with Nmap, Patin found several hosts which have the IP ID of incremental kiosk.adobe.com is the host with incremental IP ID sequence. What is the purpose of using "-sl" with Nmap?

The correct answer is C. Conduct IDLE scan. The Nmap '-sI' flag (rendered as '-sl' due to font ambiguity between uppercase I and lowercase l) initiates an idle scan, which uses a zombie host with an incremental IP ID sequence to anonymously probe a target.

Scanning Networks

Question

While scanning with Nmap, Patin found several hosts which have the IP ID of incremental kiosk.adobe.com is the host with incremental IP ID sequence. What is the purpose of using "-sl" with Nmap?

Options

  • AConduct stealth scan
  • BConduct ICMP scan
  • CConduct IDLE scan
  • DConduct silent scan

How the community answered

(33 responses)
  • A
    9% (3)
  • B
    3% (1)
  • C
    85% (28)
  • D
    3% (1)

Why each option

The Nmap '-sI' flag (rendered as '-sl' due to font ambiguity between uppercase I and lowercase l) initiates an idle scan, which uses a zombie host with an incremental IP ID sequence to anonymously probe a target.

AConduct stealth scan

Stealth scans in Nmap are performed with '-sS' (SYN scan), not '-sI'.

BConduct ICMP scan

ICMP scans use '-sn' or '-PE' flags and send ICMP echo requests, which is a different technique unrelated to IP ID sequence exploitation.

CConduct IDLE scanCorrect

The '-sI' flag in Nmap performs an Idle scan, which works by exploiting a zombie host that has a predictable, incremental IP ID sequence. The scanner sends spoofed packets appearing to come from the zombie to the target, then monitors the zombie's IP ID counter to infer whether the target's ports are open, never directly communicating with the target and thus remaining hidden.

DConduct silent scan

'Silent scan' is not a defined Nmap scan type associated with this flag or the IP ID incremental sequence technique described.

Concept tested: Nmap idle scan using zombie host IP ID

Source: https://nmap.org/book/idlescan.html

Topics

#Nmap idle scan#IP ID sequence#zombie host#stealth scanning

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice