PT0-002 · Question #279
The attacking machine is on the same LAN segment as the target host during an internal penetration test. Which of the following commands will BEST enable the attacker to conduct host discovery and…
The correct answer is A. nmap -sn -n -exclude 10.1.1.15 10.1.1.0/24 -oA target_txt. To perform host discovery on a local LAN segment, exclude the attacking machine, and save the results, the Nmap command should use -sn for ping scan, -exclude for the attacker's IP, and -oA for comprehensive output.
Question
The attacking machine is on the same LAN segment as the target host during an internal penetration test. Which of the following commands will BEST enable the attacker to conduct host discovery and write the discovery to files without returning results of the attack machine?
Options
- Anmap -sn -n -exclude 10.1.1.15 10.1.1.0/24 -oA target_txt
- Bnmap -iR 10 -n -oX out.xml | grep "Nmap" | cut -d "" -f5 > live-hosts.txt
- Cnmap -Pn -sV -O -iL target.txt -oA target_text_Service
- Dnmap -sS -Pn -n -iL target.txt -oA target_txt1
How the community answered
(28 responses)- A71% (20)
- B14% (4)
- C11% (3)
- D4% (1)
Why each option
To perform host discovery on a local LAN segment, exclude the attacking machine, and save the results, the Nmap command should use -sn for ping scan, -exclude for the attacker's IP, and -oA for comprehensive output.
The nmap -sn command performs a ping scan for host discovery, -n disables DNS resolution for speed, -exclude 10.1.1.15 prevents the attacker's machine from being included in the results, and -oA target_txt saves the output in multiple formats, fulfilling all requirements.
The -iR 10 option scans 10 random hosts, which is not suitable for a specific LAN segment, and the post-processing using grep and cut is an inefficient and less reliable method compared to Nmap's dedicated output options.
The -Pn option skips host discovery and treats all hosts as online, which is contrary to the goal of host discovery, and -sV -O are for service/OS detection, not basic host discovery.
The -sS option performs a SYN port scan, not just host discovery, and -Pn skips host discovery, making it unsuitable for the stated objective.
Concept tested: Nmap host discovery and output options
Source: https://nmap.org/book/man.html
Topics
Community Discussion
No community discussion yet for this question.