During a client engagement, a penetration tester runs the following Nmap command and obtains the following output: Which of the following should the penetration tester include in the report?

The correct answer is A. Old, insecure ciphers are in use. Nmap's ssl-enum-ciphers script enumerates all TLS/SSL cipher suites a server supports and grades each one. If the output reveals cipher suites rated 'F' or 'weak' - such as RC4, NULL ciphers, EXPORT-grade ciphers, or those using DES - the finding is that old, insecure ciphers…

Vulnerability discovery and analysis

Question

During a client engagement, a penetration tester runs the following Nmap command and obtains the following output:

Which of the following should the penetration tester include in the report?

Exhibit

Options

AOld, insecure ciphers are in use.
BThe 3DES algorithm should be deprecated.
C2,048-bit symmetric keys are incompatible with MD5.
DThis server should be upgraded to TLS 1.2.

How the community answered

(27 responses)

A
81% (22)
B
4% (1)
C
11% (3)
D
4% (1)

Explanation

Nmap's ssl-enum-ciphers script enumerates all TLS/SSL cipher suites a server supports and grades each one. If the output reveals cipher suites rated 'F' or 'weak' - such as RC4, NULL ciphers, EXPORT-grade ciphers, or those using DES - the finding is that old, insecure ciphers are in use. This is a direct and accurate statement of the vulnerability. 3DES (Triple DES) is weak but the finding is broader than just 3DES deprecation. Symmetric key lengths and MD5 compatibility are separate issues. The question context shows a TLS scan, not a version negotiation issue, and the output would highlight cipher-level weaknesses rather than a protocol version downgrade to TLS 1.2.

Topics

#Nmap scanning#SSL/TLS vulnerabilities#Weak ciphers#Vulnerability reporting

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice