nerdexam
GIAC

GCIH · Question #321

John works as a professional Ethical Hacker. He has been assigned the project of testing the and applications running on the We-are-secure server. For this purpose, he wants to initiate scanning…

The correct answer is B. IDLE. The IDLE scan technique allows an attacker to port scan a target using a spoofed third-party IP address, making the scan appear to originate from another host.

Reconnaissance, Scanning, and Enumeration

Question

John works as a professional Ethical Hacker. He has been assigned the project of testing the and applications running on the We-are-secure server. For this purpose, he wants to initiate scanning with the IP address of any third party. Which of the following scanning techniques will John use to accomplish his task?

Options

  • ARPC
  • BIDLE
  • CUDP
  • DTCP SYN/ACK

How the community answered

(64 responses)
  • A
    6% (4)
  • B
    89% (57)
  • C
    2% (1)
  • D
    3% (2)

Why each option

The IDLE scan technique allows an attacker to port scan a target using a spoofed third-party IP address, making the scan appear to originate from another host.

ARPC

RPC scanning targets Remote Procedure Call services and does not provide the ability to disguise the scan origin behind a third-party IP address.

BIDLECorrect

The IDLE scan (also called zombie scan) technique exploits a third-party host with predictable IP ID sequence numbers to relay scan packets, so the target receives probes that appear to come from the zombie's IP address rather than the attacker's. This allows the ethical hacker to initiate scanning while hiding behind the IP of an unrelated third party. Nmap implements this technique using the -sI flag.

CUDP

UDP scanning sends UDP packets to discover open ports but does not inherently support IP spoofing or use a third-party address to mask the scan source.

DTCP SYN/ACK

TCP SYN/ACK scanning is used for firewall rule inference by sending unsolicited SYN/ACK packets, but it does not use a third-party IP to obscure the attacker's origin.

Concept tested: IDLE zombie scan for IP address spoofing

Source: https://nmap.org/book/idlescan.html

Topics

#IDLE scan#zombie scan#IP spoofing#stealth scanning

Community Discussion

No community discussion yet for this question.

Full GCIH Practice