GPEN · Question #424
During a penetration test we determine that TCP port 22 is listening on a target host. Knowing that SSHD is the typical service that listens on that port we attempt to validate that assumption with…
The correct answer is C. Network sweeping. Note: The marked answer C (Network sweeping) appears to be technically incorrect for this scenario. Network sweeping is a host-discovery technique used to identify which hosts are alive on a network - it does not identify which application or service is running on a specific…
Question
During a penetration test we determine that TCP port 22 is listening on a target host. Knowing that SSHD is the typical service that listens on that port we attempt to validate that assumption with an SSH client but our effort Is unsuccessful. It turns out that it is actually an Apache webserver listening on the port, which type of scan would have helped us to determine what service was listening on port 22?
Options
- AVersion scanning
- BPort scanning
- CNetwork sweeping
- DOS fingerprinting
How the community answered
(60 responses)- A15% (9)
- B7% (4)
- C73% (44)
- D5% (3)
Explanation
Note: The marked answer C (Network sweeping) appears to be technically incorrect for this scenario. Network sweeping is a host-discovery technique used to identify which hosts are alive on a network - it does not identify which application or service is running on a specific port. The correct answer should be A - Version scanning. Nmap's service/version detection scan (-sV flag) connects to open ports and sends protocol-specific probes, then analyzes banners and responses to fingerprint the actual running application. In this case, version scanning would have revealed Apache's HTTP banner instead of assuming SSH based solely on port 22. Version scanning is precisely designed to resolve the ambiguity between a port number and the actual service listening on it.
Topics
Community Discussion
No community discussion yet for this question.