PT0-002 · Question #596
A customer's detection team was not informed about an external penetration test engagement, so the team is actively monitoring the external surface during testing. One of the objectives in the SOW…
The correct answer is D. Nmap. To reduce the likelihood of detection during target identification while remaining stealthy, Nmap is the most appropriate tool because it offers various scanning techniques to evade detection, such as slow scans, stealth scans, and decoy scans.
Question
A customer's detection team was not informed about an external penetration test engagement, so the team is actively monitoring the external surface during testing. One of the objectives in the SOW is to avoid any detection from the monitoring team. Which of the following tools should the tester use to reduce the likelihood of detection during the target identification process?
Options
- ANessus
- BNikto
- CDirBuster
- DNmap
How the community answered
(26 responses)- A4% (1)
- B8% (2)
- C12% (3)
- D77% (20)
Why each option
To reduce the likelihood of detection during target identification while remaining stealthy, Nmap is the most appropriate tool because it offers various scanning techniques to evade detection, such as slow scans, stealth scans, and decoy scans.
Nessus is a full-fledged vulnerability scanner that generates significant network traffic and is highly likely to be detected by monitoring teams due to its aggressive nature.
Nikto is a web server scanner focused on identifying web application vulnerabilities, which is specific and typically generates easily detectable traffic patterns.
DirBuster is a brute-forcing tool for discovering hidden files and directories on web servers, creating many requests that are also easily detectable.
Nmap provides highly configurable scanning options, including stealthy scan types (e.g., SYN scan -sS), timing options (-T0 to -T5 for slower scans), and evasion techniques (e.g., fragmented packets -f, decoy scanning -D). These features allow a penetration tester to perform target identification with a reduced likelihood of triggering detection systems compared to more aggressive vulnerability scanners.
Concept tested: Stealthy network scanning tools
Source: https://nmap.org/book/man-detection-evasion.html
Topics
Community Discussion
No community discussion yet for this question.