A penetration tester is scanning a corporate lab network for potentially vulnerable services. Which of the following Nmap commands will return vulnerable ports that might be interesting to a…

The correct answer is C. nmap 192.168.1.1-5 -PS22-25,80. The -PS flag in Nmap performs a TCP SYN ping scan against specified ports, sending SYN packets and identifying hosts that respond (indicating the port is open or at least reachable). The command nmap 192.168.1.1-5 -PS22-25,80 probes the host range across ports 22 (SSH), 23…

Information Gathering and Vulnerability Scanning

Question

A penetration tester is scanning a corporate lab network for potentially vulnerable services. Which of the following Nmap commands will return vulnerable ports that might be interesting to a potential attacker?

Options

Anmap 192.168.1.1-5 -PU22-25,80
Bnmap 192.168.1.1-5 -PA22-25,80
Cnmap 192.168.1.1-5 -PS22-25,80
Dnmap 192.168.1.1-5 -Ss22-25,80

How the community answered

(31 responses)

A
10% (3)
B
3% (1)
C
81% (25)
D
6% (2)

Explanation

The -PS flag in Nmap performs a TCP SYN ping scan against specified ports, sending SYN packets and identifying hosts that respond (indicating the port is open or at least reachable). The command nmap 192.168.1.1-5 -PS22-25,80 probes the host range across ports 22 (SSH), 23 (Telnet), 24, 25 (SMTP), and 80 (HTTP) - all ports commonly of interest to attackers. Option A (-PU) sends UDP packets for host discovery, less reliable for identifying open TCP services. Option B (-PA) sends TCP ACK packets, which can discover hosts behind stateless firewalls but is less effective at identifying open ports since a SYN packet reveals port state more clearly. Option D (-Ss) is not a valid Nmap flag; the correct flag for a SYN stealth scan is -sS (lowercase s, uppercase S) - the capitalization in -Ss makes it invalid.

Topics

#Nmap#Port scanning#Service discovery#Reconnaissance

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice