nerdexam
GIAC

GPEN · Question #139

You work as a Penetration Tester for the Infosec Inc. Your company takes the projects of security auditing. Recently, your company has assigned you a project to test the security of the we- aresecure.

The correct answer is C. The we-are-secure.com server is using a TCP wrapper.. A TCP wrapper on the Linux server intercepts the telnet connection and returns blank or meaningless output instead of exposing a real shell, which is why Windows-style commands produce only spaces or underscores.

Vulnerability Discovery & Scanning

Question

You work as a Penetration Tester for the Infosec Inc. Your company takes the projects of security auditing. Recently, your company has assigned you a project to test the security of the we- aresecure. com Website. The we-are-secure.com Web server is using Linux operating system. When you port scanned the we-are-secure.com Web server, you got that TCP port 23, 25, and 53 are open. When you tried to telnet to port 23, you got a blank screen in response. When you tried to type the dir, copy, date, del, etc. commands you got only blank spaces or underscores symbols on the screen. What may be the reason of such unwanted situation?

Options

  • AThe telnet session is being affected by the stateful inspection firewall.
  • BThe telnet service of we-are-secure.com has corrupted.
  • CThe we-are-secure.com server is using a TCP wrapper.
  • DThe we-are-secure.com server is using honeypot.

How the community answered

(22 responses)
  • A
    14% (3)
  • B
    5% (1)
  • C
    77% (17)
  • D
    5% (1)

Why each option

A TCP wrapper on the Linux server intercepts the telnet connection and returns blank or meaningless output instead of exposing a real shell, which is why Windows-style commands produce only spaces or underscores.

AThe telnet session is being affected by the stateful inspection firewall.

A stateful inspection firewall would typically block the TCP connection entirely or reset it rather than allow a session to open and then return blank or garbled responses to typed commands.

BThe telnet service of we-are-secure.com has corrupted.

A corrupted telnet service would most likely crash or fail to accept the connection at all, not maintain a stable session that silently swallows commands and returns underscores.

CThe we-are-secure.com server is using a TCP wrapper.Correct

TCP wrappers (via hosts.allow/hosts.deny and the tcpd daemon) intercept inbound connections to services like telnet before handing them to the actual daemon; when configured to block or restrict a client, the wrapper can accept the TCP connection but suppress or distort all output, resulting in the blank screen and garbage responses observed when typing commands.

DThe we-are-secure.com server is using honeypot.

A honeypot would typically emulate a convincing service with realistic responses to lure and log an attacker; returning only blank spaces and underscores is characteristic of a TCP wrapper restriction, not a honeypot interaction.

Concept tested: Linux TCP wrappers intercepting and restricting service access

Source: https://linux.die.net/man/5/hosts_access

Topics

#TCP wrappers#port scanning#telnet#Linux access control

Community Discussion

No community discussion yet for this question.

Full GPEN Practice