NMAP Familiarity CEH 1.5

Match the following

• Threat Feed

• An individual, group, or entity that carries out malicious activities with the intent to compromise the security of a system or network.

• Threat Remediation

• the sum of all the points or areas in a system, network, or application that are vulnerable to potential security threats.

• Threat Actor

• The method or pathway that an attacker employs to exploit vulnerabilities in a system or network to carry out an attack.

• Attack Vector

• A stream of real-time or regularly updated information about current and emerging cybersecurity threats.

• Attack Surface

• The process of addressing and mitigating security threats or vulnerabilities in a system or network.

Match these general terms:

• Active Reconnaissance

• Taking information from publicly available websites and web pages.

• Web Scraping

• Involves collecting information without directly interacting with the target. This can include searching public records, social media profiles, WHOIS databases, and other publicly available sources.

• Passive Reconnaissance

• Involves actively probing the target systems to gather information. This may include network scanning, port scanning, and other techniques to discover live hosts, open ports, and services.

• Fingerprinting

• A term used to define the technique of mapping out a network.

• Footprinting

• A term used to define the technique of finding very detailed information about a target on a network.

NMAP's default scan is often referred to as a vanilla scan. Nmap attempts to establish a full TCP connection with the target host for the most common 1,000 TCP ports. This scan is executed if you do not provide any arguments. Example: nmap [target]. What is this scan known as?

• XMAS Tree Scan

• SYN Stealth Scan

• TCP Connect Scan

• UDP Scan

Which of the following is NMAP not used for?

• Port Discovery

• Active Reconnaissance

• Forging TCP Packets

• Host Discovery

Match the timing templates to the correct speeds for NMAP scans.

• t5 - Insane

• • Default timing template.

  • Balances speed with caution to avoid causing disruption.

• t4 - Aggressive

• • Slower than the default.

  • Intended to be stealthy but still reasonably fast.

• t2 - Polite

• • Faster and more aggressive than the default.

  • Can increase the likelihood of detection but provides quicker results.

• t1 - Sneaky

• • A balanced and moderate timing template.

  • It is often a good choice for general-purpose scanning.

• t3 - Normal

• • Very fast and aggressive.

  • Increases the chances of being detected and can put a heavier load on the network and target system.

Answer explanation

t0 - Paranoid:

• Very slow and cautious.

• Designed to minimize the chances of detection by the target system.

This term is used when a threat actor is attempting to discover and map the active hosts or devices on a network. The threat actors goal is to make a complete map so that they can accurately assess the attack surface of an organization.

• Footprinting

• Fingerprinting

• Port Discovery

By default, NMAP performs host discovery to see what computers are available to scan. This argument assumes that the host is already online, directing the NMAP program to skip looking for the host and proceed straight to port scanning.

• -sS

• -sV

• -A

• -Pn

Answer explanation

-sS = TCP Syn Port Scan

-sV = Version Scan

-A = OS Detection Scan

-Pn = Port Scan Only, No Host

What argument will direct NMAP to perform a UDP Port Scan?

• -Su

• -sU

• -SU

• -sP

This scan attempts to determine the specific versions of services and applications running on the target system by analyzing their responses to Nmap probes. It performs version detection on open ports.

• -sT

• -sS

• -sV

• -Pn

When you include this flag in your Nmap command, Nmap tries to identify the operating system version running on the target hosts based on various characteristics of the network packets it receives in response to its probes.

• -A

• -p-

• -sV

• -Su