312-50V10 · Question #748
While scanning with Nmap, Patin found several hosts which have the IP ID of incremental kiosk.adobe.com is the host with incremental IP ID sequence. What is the purpose of using "-sl" with Nmap?
The correct answer is C. Conduct IDLE scan. The Nmap '-sI' flag (rendered as '-sl' due to font ambiguity between uppercase I and lowercase l) initiates an idle scan, which uses a zombie host with an incremental IP ID sequence to anonymously probe a target.
Question
While scanning with Nmap, Patin found several hosts which have the IP ID of incremental kiosk.adobe.com is the host with incremental IP ID sequence. What is the purpose of using "-sl" with Nmap?
Options
- AConduct stealth scan
- BConduct ICMP scan
- CConduct IDLE scan
- DConduct silent scan
How the community answered
(33 responses)- A9% (3)
- B3% (1)
- C85% (28)
- D3% (1)
Why each option
The Nmap '-sI' flag (rendered as '-sl' due to font ambiguity between uppercase I and lowercase l) initiates an idle scan, which uses a zombie host with an incremental IP ID sequence to anonymously probe a target.
Stealth scans in Nmap are performed with '-sS' (SYN scan), not '-sI'.
ICMP scans use '-sn' or '-PE' flags and send ICMP echo requests, which is a different technique unrelated to IP ID sequence exploitation.
The '-sI' flag in Nmap performs an Idle scan, which works by exploiting a zombie host that has a predictable, incremental IP ID sequence. The scanner sends spoofed packets appearing to come from the zombie to the target, then monitors the zombie's IP ID counter to infer whether the target's ports are open, never directly communicating with the target and thus remaining hidden.
'Silent scan' is not a defined Nmap scan type associated with this flag or the IP ID incremental sequence technique described.
Concept tested: Nmap idle scan using zombie host IP ID
Source: https://nmap.org/book/idlescan.html
Topics
Community Discussion
No community discussion yet for this question.