GPEN · Question #402
Analyze the command output below. Given this information, which is the appropriate next step for the tester? Starting Nmap4.53 (hnp://insecure.org I at2010-09-30 19:13 EDT interesting ports on…
The correct answer is B. Send a single SYN packet to port 139/tcp on the host. The Nmap output shows port 139/tcp (NetBIOS-SSN) is the only open port on a Windows XP SP2 host; the next step is to directly verify TCP connectivity to that port before proceeding with enumeration or exploitation.
Question
Analyze the command output below. Given this information, which is the appropriate next step for the tester? Starting Nmap4.53 (hnp://insecure.org I at2010-09-30 19:13 EDT interesting ports on 192.163.116.101:
PORT STATE SERVICE 130/tcp filtered cisco-fna 131/tcp filtered cisco-tna 132/tcp filtered cisco-sys 133/tcp filtered statsrv 134/tcp filtered Ingres-net 135/tcp filtered msrpc 136/tcp filtered profile 137/tcp filtered netbios-ns 138/tcp filtered netbios-dgm 139/tcp open netbios-ssn 140/tcp filtered emfis-data MAC Address: 00:30:1&:B8:14:8B (Shuttle) warning: OSS can results may be unreliable because we could not find at least l open and l closed port Device type, general purpose Running: Microsoft Windows XP OS details: Microsoft Windows XP SP2 Network Distance : 1 hop Nmap done: I IP address (I host up) scanned in l .263 seconds
Options
- ADetermine the MAC address of the scanned host.
- BSend a single SYN packet to port 139/tcp on the host.
- CSend spoofed packets to attempt to evade any firewall
- DRequest a list of shares from the scanned host.
How the community answered
(29 responses)- A14% (4)
- B76% (22)
- C7% (2)
- D3% (1)
Why each option
The Nmap output shows port 139/tcp (NetBIOS-SSN) is the only open port on a Windows XP SP2 host; the next step is to directly verify TCP connectivity to that port before proceeding with enumeration or exploitation.
The MAC address (00:30:18:B8:14:8B) is already visible in the Nmap output, so attempting to determine it again yields no new information.
Port 139 is the NetBIOS Session Service used by Windows for SMB-based file and print sharing. Sending a single SYN packet to port 139 is a targeted test to confirm the service is actively accepting TCP connections before proceeding to NetBIOS enumeration. This direct verification step ensures the open state reported by Nmap is accurate and that the service is reachable for further testing.
The scan results do not indicate that firewall evasion is required; the tester has already successfully retrieved OS fingerprinting and port state data, so spoofed packets are unnecessary at this point.
Requesting a list of shares is a valid enumeration step for NetBIOS but is premature before first confirming direct TCP connectivity to port 139 with a targeted SYN test.
Concept tested: NetBIOS port verification and pentest next-step selection
Source: https://nmap.org/book/man-port-scanning-techniques.html
Topics
Community Discussion
No community discussion yet for this question.