GPEN · Question #297
John works as a Network Security Professional. He is assigned a project to test the security of with netcat and sends a bad html request in order to retrieve information about the service on the host.
The correct answer is A. Banner grabbing. Banner grabbing involves connecting to a service and sending a request (often malformed) to read the response header and identify software type and version. John uses netcat to send a bad HTTP request and capture the server's response banner.
Question
John works as a Network Security Professional. He is assigned a project to test the security of with netcat and sends a bad html request in order to retrieve information about the service on the host. Which of the following attacks is John using?
Exhibit
Options
- ABanner grabbing
- BWar driving
- CEavesdropping
- DSniffing
How the community answered
(45 responses)- A71% (32)
- B18% (8)
- C7% (3)
- D4% (2)
Why each option
Banner grabbing involves connecting to a service and sending a request (often malformed) to read the response header and identify software type and version. John uses netcat to send a bad HTTP request and capture the server's response banner.
Banner grabbing is a reconnaissance technique where an attacker connects to an open port and sends a crafted or malformed request to elicit a service response that reveals the server software, version, and OS. Using netcat to send a bad HTTP request and reading the resulting response headers is a textbook example of active banner grabbing performed during the pre-attack information gathering phase.
War driving involves physically driving around with wireless scanning equipment to detect and enumerate nearby Wi-Fi networks, which is unrelated to probing a specific host with netcat.
Eavesdropping is the passive interception of communications between two parties without their knowledge, not the active probing of a service with crafted requests.
Sniffing is the passive capture of network packets as they traverse a shared medium or network segment, not the active technique of sending requests to a host to read its banner.
Concept tested: Banner grabbing for service fingerprinting
Source: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/02-Fingerprint_Web_Server
Topics
Community Discussion
No community discussion yet for this question.
