CEH Footprinting, Reconnaissance and Scanning Practice Question

A security team detects unusual outbound traffic from a host that appears to be a reverse shell. Which of the following Nmap features would be MOST effective for identifying the service running on the listening port of the command-and-control server?

⚠ Common exam trap

Test-takers frequently confuse OS fingerprinting (-O) with service version detection (-sV), thinking that identifying the OS will reveal the service, but the CEH exam emphasizes that -sV is the dedicated flag for service and version identification on listening ports.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Service version detection using the -sV flag

The -sV flag instructs Nmap to perform service version detection by probing open ports and analyzing the responses to determine the exact application and version running on the listening port. In a reverse shell scenario, identifying the service (e.g., a specific SSH, HTTP, or custom listener) on the C2 server is critical for understanding the attack vector and planning remediation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
UDP scan using the -sU flag
Why it's wrong here
A UDP scan using the -sU flag is designed to identify open UDP ports by sending UDP packets and analyzing ICMP responses or lack thereof. However, reverse shells predominantly utilize TCP for reliable, ordered data transmission and easier firewall traversal, making a UDP-specific scan largely ineffective for their detection. Furthermore, -sU only determines the port's state (open/closed/filtered) for UDP, it does not perform service banner grabbing or protocol analysis to identify the specific application or version running on that port.
✗
Nmap Scripting Engine (NSE) with the http-enum script
Why it's wrong here
The Nmap Scripting Engine (NSE) with the http-enum script is specifically crafted to enumerate directories and files on web servers by attempting to guess common paths and filenames. This script operates at the application layer, assuming an HTTP service is already present and accessible. It is not designed for general service identification on arbitrary ports or for discerning the nature of an unknown, non-HTTP service like a reverse shell, which may use a custom or different protocol.
✗
OS fingerprinting using the -O flag
Why it's wrong here
OS fingerprinting using the -O flag attempts to identify the operating system of the target host by analyzing subtle variations in its TCP/IP stack implementation, such as initial TCP window size, SYN packet options, and ICMP error message details. While crucial for understanding the target environment, this technique focuses solely on the underlying OS. It does not probe individual open ports to determine the specific application, service banner, or protocol running on them, which is essential for identifying a reverse shell.
✓
Service version detection using the -sV flag
Why this is correct
Service version detection using the -sV flag is the most appropriate technique as it actively probes open ports, collects service banners, and compares the responses against Nmap's extensive nmap-service-probes database. This method allows for the precise identification of the service name, version, and sometimes even the underlying protocol, even if it's an unusual or custom service like a reverse shell listening on a non-standard port. This direct service identification is critical for understanding the nature of the unusual outbound traffic.

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question