PT0-002 · Question #349
During a vulnerability scan a penetration tester enters the following Nmap command against all of the non-Windows clients: nmap -sX -T4 -p 21-25, 67, 80, 139, 8080 192.168.11.191 The penetration…
The correct answer is A. All of the ports in the target range are closed. The Nmap command uses the Xmas scan technique, which sends packets with the FIN, PSH, and URG flags set. This is an attempt to bypass firewall rules and elicit a response from open ports. However, if the target responds with an RST packet, it means that the port is closed. Open…
Question
During a vulnerability scan a penetration tester enters the following Nmap command against all of the non-Windows clients:
nmap -sX -T4 -p 21-25, 67, 80, 139, 8080 192.168.11.191 The penetration tester reviews the packet capture in Wireshark and notices that the target responds with an RST packet flag set for all of the targeted ports. Which of the following does this information most likely indicate?
Options
- AAll of the ports in the target range are closed.
- BNmap needs more time to scan the ports in the target range.
- CThe ports in the target range cannot be scanned because they are common UDP ports.
- DAll of the ports in the target range are open.
How the community answered
(43 responses)- A79% (34)
- B7% (3)
- C12% (5)
- D2% (1)
Explanation
The Nmap command uses the Xmas scan technique, which sends packets with the FIN, PSH, and URG flags set. This is an attempt to bypass firewall rules and elicit a response from open ports. However, if the target responds with an RST packet, it means that the port is closed. Open ports will either ignore the Xmas scan packets or send back an ACK packet. Therefore, the information most likely indicates that all of the ports in the target range are closed.
Topics
Community Discussion
No community discussion yet for this question.