nerdexam
EC-Council

312-50V12 · Question #220

During a penetration testing assignment, a Certified Ethical Hacker (CEH) used a set of scanning tools to create a profile of the target organization. The CEH wanted to scan for live hosts, open…

The correct answer is D. Hping3 -S 192.168.1.1 -a 192.168.1.254 -p 22 --flood. This question tests knowledge of Hping3 commands for spoofing source IP addresses during network probing. The correct command uses Hping3's spoofing flag to disguise the attacker's real IP address.

Submitted by lucia.co· Mar 4, 2026Reconnaissance Techniques

Question

During a penetration testing assignment, a Certified Ethical Hacker (CEH) used a set of scanning tools to create a profile of the target organization. The CEH wanted to scan for live hosts, open ports, and services on a target network. He used Nmap for network inventory and Hping3 for network security auditing. However, he wanted to spoof IP addresses for anonymity during probing. Which command should the CEH use to perform this task?

Options

  • AHping3 -1 10.0.0.25 -ICMP
  • BHping3 -2 10.0.0.25-p 80
  • CNmap -sS -Pn -n -vw --packet-trace -p- --script discovery -T4
  • DHping3 -S 192.168.1.1 -a 192.168.1.254 -p 22 --flood

How the community answered

(44 responses)
  • A
    5% (2)
  • B
    11% (5)
  • C
    2% (1)
  • D
    82% (36)

Why each option

This question tests knowledge of Hping3 commands for spoofing source IP addresses during network probing. The correct command uses Hping3's spoofing flag to disguise the attacker's real IP address.

AHping3 -1 10.0.0.25 -ICMP

Hping3 -1 10.0.0.25 -ICMP sends ICMP packets (ping-like) to the target but includes no '-a' spoofing flag, meaning the attacker's real IP address is exposed.

BHping3 -2 10.0.0.25-p 80

Hping3 -2 10.0.0.25 -p 80 sends UDP packets to port 80 on the target but does not include any IP spoofing option, providing no anonymity for the attacker.

CNmap -sS -Pn -n -vw --packet-trace -p- --script discovery -T4

The Nmap command performs a comprehensive SYN scan with scripting and packet tracing but does not include IP spoofing (which would require the '-S' or '--spoof-mac' flags in Nmap), and it uses Nmap rather than Hping3 as specified for the spoofing task.

DHping3 -S 192.168.1.1 -a 192.168.1.254 -p 22 --floodCorrect

Hping3 -S 192.168.1.1 -a 192.168.1.254 -p 22 --flood uses the '-a' flag (spoof) to set a spoofed source IP address (192.168.1.254), satisfying the anonymity requirement. The '-S' flag sends TCP SYN packets to the target (192.168.1.1) on port 22, while '--flood' sends packets as fast as possible, making this the only command in the list that directly addresses IP address spoofing during probing.

Concept tested: Hping3 IP spoofing for anonymous network probing

Source: https://www.kali.org/tools/hping3/

Topics

#Hping3#IP spoofing#Network scanning#Anonymity

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice