312-50V12 Question #220: Real Exam Question with Answer & Explanation

Question

During a penetration testing assignment, a Certified Ethical Hacker (CEH) used a set of scanning tools to create a profile of the target organization. The CEH wanted to scan for live hosts, open ports, and services on a target network. He used Nmap for network inventory and Hping3 for network security auditing. However, he wanted to spoof IP addresses for anonymity during probing. Which command should the CEH use to perform this task?

Options

• AHping3 -1 10.0.0.25 -ICMP
• BHping3 -2 10.0.0.25-p 80
• CNmap -sS -Pn -n -vw --packet-trace -p- --script discovery -T4
• DHping3 -S 192.168.1.1 -a 192.168.1.254 -p 22 --flood

Explanation

This question tests knowledge of Hping3 commands for spoofing source IP addresses during network probing. The correct command uses Hping3's spoofing flag to disguise the attacker's real IP address.

Common mistakes.

• A. Hping3 -1 10.0.0.25 -ICMP sends ICMP packets (ping-like) to the target but includes no '-a' spoofing flag, meaning the attacker's real IP address is exposed.
• B. Hping3 -2 10.0.0.25 -p 80 sends UDP packets to port 80 on the target but does not include any IP spoofing option, providing no anonymity for the attacker.
• C. The Nmap command performs a comprehensive SYN scan with scripting and packet tracing but does not include IP spoofing (which would require the '-S' or '--spoof-mac' flags in Nmap), and it uses Nmap rather than Hping3 as specified for the spoofing task.

Concept tested. Hping3 IP spoofing for anonymous network probing

Reference. https://www.kali.org/tools/hping3/

No community discussion yet for this question.