312-50V11 · Question #495
You've just discovered a server that is currently active within the same network with the machine you recently compromised. You ping it but it did not respond. What could be the case?
The correct answer is C. ICMP could be disabled on the target server. A server that does not respond to ping is most likely blocking ICMP traffic, which is a common network hardening practice to reduce attack surface.
Question
You've just discovered a server that is currently active within the same network with the machine you recently compromised. You ping it but it did not respond. What could be the case?
Options
- ATCP/IP doesn't support ICMP
- BARP is disabled on the target server
- CICMP could be disabled on the target server
- DYou need to run the ping command with root privileges
How the community answered
(38 responses)- B3% (1)
- C92% (35)
- D5% (2)
Why each option
A server that does not respond to ping is most likely blocking ICMP traffic, which is a common network hardening practice to reduce attack surface.
TCP/IP fully supports ICMP - ICMP is a core protocol within the TCP/IP suite used for diagnostics and error reporting.
ARP (Address Resolution Protocol) resolves IP addresses to MAC addresses on a local network and has no role in responding to ICMP echo requests.
ICMP (Internet Control Message Protocol) is frequently disabled on servers through host-based firewalls or OS-level configuration as a security measure to prevent reconnaissance. When ICMP echo requests are blocked or dropped by the target, the ping command receives no reply, making the host appear unreachable even though it is active on the network.
On modern operating systems, the ping command does not require root or administrator privileges to send ICMP echo requests to a host on the same network.
Concept tested: ICMP blocking as a network hardening technique
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/create-an-inbound-icmp-rule
Topics
Community Discussion
No community discussion yet for this question.