GCIH · Question #321
John works as a professional Ethical Hacker. He has been assigned the project of testing the and applications running on the We-are-secure server. For this purpose, he wants to initiate scanning…
The correct answer is B. IDLE. The IDLE scan technique allows an attacker to port scan a target using a spoofed third-party IP address, making the scan appear to originate from another host.
Question
John works as a professional Ethical Hacker. He has been assigned the project of testing the and applications running on the We-are-secure server. For this purpose, he wants to initiate scanning with the IP address of any third party. Which of the following scanning techniques will John use to accomplish his task?
Options
- ARPC
- BIDLE
- CUDP
- DTCP SYN/ACK
How the community answered
(64 responses)- A6% (4)
- B89% (57)
- C2% (1)
- D3% (2)
Why each option
The IDLE scan technique allows an attacker to port scan a target using a spoofed third-party IP address, making the scan appear to originate from another host.
RPC scanning targets Remote Procedure Call services and does not provide the ability to disguise the scan origin behind a third-party IP address.
The IDLE scan (also called zombie scan) technique exploits a third-party host with predictable IP ID sequence numbers to relay scan packets, so the target receives probes that appear to come from the zombie's IP address rather than the attacker's. This allows the ethical hacker to initiate scanning while hiding behind the IP of an unrelated third party. Nmap implements this technique using the -sI flag.
UDP scanning sends UDP packets to discover open ports but does not inherently support IP spoofing or use a third-party address to mask the scan source.
TCP SYN/ACK scanning is used for firewall rule inference by sending unsolicited SYN/ACK packets, but it does not use a third-party IP to obscure the attacker's origin.
Concept tested: IDLE zombie scan for IP address spoofing
Source: https://nmap.org/book/idlescan.html
Topics
Community Discussion
No community discussion yet for this question.