GCIH · Question #281
You work as a Penetration Tester for the Infosec Inc. Your company takes the projects of security auditing. Recently, your company has assigned you a project to test the security of the we…
The correct answer is C. The zombie computer is the system interacting with some other system besides your. In an idle scan, irregular IPID increments indicate the zombie host is actively communicating with other systems, making its IPID sequence unreliable for inferring open ports on the target.
Question
You work as a Penetration Tester for the Infosec Inc. Your company takes the projects of security auditing. Recently, your company has assigned you a project to test the security of the we- aresecure.com Web site. For this, you want to perform the idle scan so that you can get the ports open in the we-are-secure.com server. You are using Hping tool to perform the idle scan by using a zombie computer. While scanning, you notice that every IPID is being incremented on every query, regardless whether the ports are open or close. Sometimes, IPID is being incremented by more than one value. What may be the reason?
Options
- AThe firewall is blocking the scanning process.
- BThe zombie computer is not connected to the we-are-secure.com Web server.
- CThe zombie computer is the system interacting with some other system besides your
- DHping does not perform idle scanning.
How the community answered
(38 responses)- A3% (1)
- B16% (6)
- C71% (27)
- D11% (4)
Why each option
In an idle scan, irregular IPID increments indicate the zombie host is actively communicating with other systems, making its IPID sequence unreliable for inferring open ports on the target.
A firewall blocking the scan would cause ports to appear filtered or closed consistently - it would not cause the zombie's IPID to increment irregularly on every query regardless of port state.
If the zombie had no connectivity to the target, the IPID would remain static for closed-port probes rather than incrementing unpredictably on every query.
An idle scan relies on a quiet zombie whose IPID counter only increments in response to forged SYN-ACK packets bounced back from the target. If the zombie is simultaneously communicating with any other system, those interactions also increment the IPID, causing the counter to increase by more than one and making it impossible to accurately determine whether the target's ports are open or closed.
Hping2 and Hping3 both support idle scanning using spoofed source addresses and IPID analysis, making this statement factually incorrect.
Concept tested: Idle scan zombie IPID reliability requirements
Source: https://nmap.org/book/idlescan.html
Topics
Community Discussion
No community discussion yet for this question.