A tester is working on an engagement that has evasion and stealth requirements. Which of the following enumeration methods is the least likely to be detected by the IDS?

Question

Options

• Acurl https://api.shodan.io/shodan/host/search?key=<API_KEY>&query=hostname:<target>
• Bproxychains nmap -sV -T2 <target>
• Cfor i in <target>; do curl -k $i; done
• Dnmap -sV -T2 <target>

• A
  79% (11)
• B
  7% (1)
• D
  14% (2)

Explanation

Explanation

Using Shodan's API (Option A) is the stealthiest approach because it performs passive reconnaissance - the tester never directly touches the target network. Instead, Shodan's pre-indexed data is queried remotely, meaning no packets are sent to the target, making IDS detection virtually impossible.

Why the distractors are wrong:

• Option B (proxychains nmap) still sends active scan traffic directly to the target; proxychains only obscures the source IP, but the scanning activity itself can still trigger IDS signatures
• Option C (curl loop) sends direct HTTP requests to the target, generating detectable traffic at the target's perimeter
• Option D (nmap -sV -T2) is active scanning that directly probes the target; -T2 slows the scan down but does not make it undetectable

Memory Tip: Think of the difference between passive and active reconnaissance. If your tool touches the target's infrastructure, an IDS can see it. Shodan is like reading someone else's notes about a building - you never set foot near it. Ask yourself: "Am I sending packets to the target?" If yes, you can be detected.

No community discussion yet for this question.