Why do protocol parsers such as sniffers often run with root or system privileges?

The correct answer is D. So they can run the network card in promiscuous mode. Flaws in these protocol parsers let the attacker get the privileges of the vulnerable program. Often, these programs run with root or system privileges so they can grab packets in promiscuous mode, and/or so they can attach to a port number less than 1024 on Unix, and/or…

Reconnaissance, Scanning, and Enumeration

Question

Options

ASo they can attach to port numbers higher than 1024 on Unix systems
BSo they can scan open files for application data
CSo they can run with application-level functionality
DSo they can run the network card in promiscuous mode

How the community answered

(33 responses)

B
3% (1)
C
3% (1)
D
94% (31)

Explanation

Flaws in these protocol parsers let the attacker get the privileges of the vulnerable program. Often, these programs run with root or system privileges so they can grab packets in promiscuous mode, and/or so they can attach to a port number less than 1024 on Unix, and/or because they involve system-level functionality.

Topics

#packet sniffing#promiscuous mode#root privileges#network interface

Community Discussion

No community discussion yet for this question.

Full GCIH Practice