nerdexam
EC-Council

312-50V11 · Question #84

Fingerprinting an Operating System helps a cracker because:

The correct answer is D. It informs the cracker of which vulnerabilities he may be able to exploit on your system. OS fingerprinting identifies the target's operating system and version, which allows an attacker to look up known vulnerabilities specific to that system.

Footprinting and Reconnaissance

Question

Fingerprinting an Operating System helps a cracker because:

Options

  • AIt defines exactly what software you have installed
  • BIt opens a security-delayed window based on the port being scanned
  • CIt doesn't depend on the patches that have been applied to fix existing security holes
  • DIt informs the cracker of which vulnerabilities he may be able to exploit on your system

How the community answered

(48 responses)
  • A
    4% (2)
  • B
    2% (1)
  • C
    2% (1)
  • D
    92% (44)

Why each option

OS fingerprinting identifies the target's operating system and version, which allows an attacker to look up known vulnerabilities specific to that system.

AIt defines exactly what software you have installed

OS fingerprinting reveals the operating system type and version, not a detailed inventory of installed applications or software packages.

BIt opens a security-delayed window based on the port being scanned

There is no recognized security concept called a 'security-delayed window' associated with OS fingerprinting or port scanning.

CIt doesn't depend on the patches that have been applied to fix existing security holes

This is factually backward - the patch level of an OS directly affects which fingerprinting-revealed vulnerabilities remain exploitable, making patches highly relevant.

DIt informs the cracker of which vulnerabilities he may be able to exploit on your systemCorrect

Once a cracker determines the OS and its version through fingerprinting techniques such as TCP/IP stack analysis or banner grabbing, they can cross-reference that information with known CVEs and public exploit databases. This gives the attacker a targeted list of vulnerabilities that may be unpatched and exploitable on the victim's system. The value of fingerprinting is precisely this mapping from OS identity to actionable attack surface.

Concept tested: OS fingerprinting and attack surface enumeration

Source: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/02-Fingerprint_Web_Server

Topics

#OS fingerprinting#vulnerability exploitation#reconnaissance#attack surface

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V11 Practice