nerdexam
GIAC

GCIH · Question #39

Which of the following statements are true about firewalking? Each correct answer represents a complete solution. Choose all that apply.

The correct answer is A. To use firewalking, the attacker needs the IP address of the last known gateway before B. In this technique, an attacker sends a crafted packet with a TTL value that is set to expire C. A malicious attacker can use firewalking to determine the types of ports/protocols that can. Firewalking is a reconnaissance technique that uses IP TTL manipulation to probe firewall rules and discover which ports and protocols are permitted. The question tests knowledge of how firewalking works and its requirements.

Reconnaissance, Scanning, and Enumeration

Question

Which of the following statements are true about firewalking? Each correct answer represents a complete solution. Choose all that apply.

Options

  • ATo use firewalking, the attacker needs the IP address of the last known gateway before
  • BIn this technique, an attacker sends a crafted packet with a TTL value that is set to expire
  • CA malicious attacker can use firewalking to determine the types of ports/protocols that can
  • DFirewalking works on the UDP packets.

How the community answered

(34 responses)
  • A
    82% (28)
  • D
    18% (6)

Why each option

Firewalking is a reconnaissance technique that uses IP TTL manipulation to probe firewall rules and discover which ports and protocols are permitted. The question tests knowledge of how firewalking works and its requirements.

ATo use firewalking, the attacker needs the IP address of the last known gateway beforeCorrect

Firewalking requires the attacker to know the IP address of the last known gateway before the firewall so that TTL values can be calculated to expire exactly one hop beyond that point.

BIn this technique, an attacker sends a crafted packet with a TTL value that is set to expireCorrect

The attacker crafts packets with a TTL set to expire one hop past the target firewall gateway, causing the firewall or next-hop router to return an ICMP TTL-exceeded message that reveals routing information.

CA malicious attacker can use firewalking to determine the types of ports/protocols that canCorrect

By analyzing which packets receive responses versus which are silently dropped, an attacker can map out the specific ports and protocols permitted through the firewall's access control rules.

DFirewalking works on the UDP packets.

Firewalking is not restricted to UDP packets - it manipulates IP-layer TTL values and can use TCP packets as well, so claiming it works exclusively on UDP is technically incorrect.

Concept tested: Firewalking technique using TTL manipulation for firewall mapping

Source: https://www.gremwell.com/firewalking

Topics

#firewalking#TTL manipulation#firewall bypass#network reconnaissance

Community Discussion

No community discussion yet for this question.

Full GCIH Practice