nerdexam
GIAC

GPEN · Question #459

Based on the partial appdefstrig rile listed below, which port scan signature is classified by AMap as harmful?

The correct answer is C. http-trace. In AMap's appdefstrig file, port scan signatures are assigned threat classifications, and http-trace is flagged as harmful due to its known exploitation potential.

Vulnerability Discovery & Scanning

Question

Based on the partial appdefstrig rile listed below, which port scan signature is classified by AMap as harmful?

Exhibit

GPEN question #459 exhibit

Options

  • Asmtp
  • Bnetbios-session
  • Chttp-trace
  • Dms-remote-desktop-protocol

How the community answered

(55 responses)
  • A
    7% (4)
  • B
    18% (10)
  • C
    71% (39)
  • D
    4% (2)

Why each option

In AMap's appdefstrig file, port scan signatures are assigned threat classifications, and http-trace is flagged as harmful due to its known exploitation potential.

Asmtp

SMTP is a standard mail transfer protocol that AMap identifies as informational; it is not classified as harmful in the default signature file because its presence alone does not indicate exploitation.

Bnetbios-session

NetBIOS Session service is a common Windows networking protocol that AMap detects and flags for awareness but does not classify as harmful by default.

Chttp-traceCorrect

The HTTP TRACE method is classified as harmful in AMap because it can be leveraged in Cross-Site Tracing (XST) attacks, where a malicious script sends a TRACE request that echoes back HTTP headers including session cookies, enabling credential theft. AMap's appdefstrig file assigns risk levels to identified application signatures, and http-trace receives a 'harmful' designation because its functionality directly exposes sensitive data when exploited.

Dms-remote-desktop-protocol

MS Remote Desktop Protocol may be noted as a sensitive service, but it is not specifically assigned a 'harmful' classification in AMap's default appdefstrig signature definitions.

Concept tested: AMap application signature threat classification

Topics

#AMap#port scanning#HTTP TRACE#signature classification

Community Discussion

No community discussion yet for this question.

Full GPEN Practice