GCIH · Question #39
Which of the following statements are true about firewalking? Each correct answer represents a complete solution. Choose all that apply.
The correct answer is A. To use firewalking, the attacker needs the IP address of the last known gateway before B. In this technique, an attacker sends a crafted packet with a TTL value that is set to expire C. A malicious attacker can use firewalking to determine the types of ports/protocols that can. Firewalking is a reconnaissance technique that uses IP TTL manipulation to probe firewall rules and discover which ports and protocols are permitted. The question tests knowledge of how firewalking works and its requirements.
Question
Which of the following statements are true about firewalking? Each correct answer represents a complete solution. Choose all that apply.
Options
- ATo use firewalking, the attacker needs the IP address of the last known gateway before
- BIn this technique, an attacker sends a crafted packet with a TTL value that is set to expire
- CA malicious attacker can use firewalking to determine the types of ports/protocols that can
- DFirewalking works on the UDP packets.
How the community answered
(34 responses)- A82% (28)
- D18% (6)
Why each option
Firewalking is a reconnaissance technique that uses IP TTL manipulation to probe firewall rules and discover which ports and protocols are permitted. The question tests knowledge of how firewalking works and its requirements.
Firewalking requires the attacker to know the IP address of the last known gateway before the firewall so that TTL values can be calculated to expire exactly one hop beyond that point.
The attacker crafts packets with a TTL set to expire one hop past the target firewall gateway, causing the firewall or next-hop router to return an ICMP TTL-exceeded message that reveals routing information.
By analyzing which packets receive responses versus which are silently dropped, an attacker can map out the specific ports and protocols permitted through the firewall's access control rules.
Firewalking is not restricted to UDP packets - it manipulates IP-layer TTL values and can use TCP packets as well, so claiming it works exclusively on UDP is technically incorrect.
Concept tested: Firewalking technique using TTL manipulation for firewall mapping
Source: https://www.gremwell.com/firewalking
Topics
Community Discussion
No community discussion yet for this question.