Footprinting, Reconnaissance and Scanning practice questions

Idle scan, fragmentation, and MAC address spoofing

Why wrong: This option is incorrect because an Idle scan (-sI) is a specific Nmap technique that leverages a 'zombie' host to bounce packets, which is distinct from general evasion tactics like fragmentation. Furthermore, MAC address spoofing operates at Layer 2 and is typically performed using operating system tools (e.g., `ifconfig` or `macchanger`) rather than being a direct Nmap scan option for evading IDS/IPS at the network layer.

Packet timing manipulation, decoy, and avoiding DNS resolution

Why wrong: This option is incorrect because packet timing manipulation, such as slowing down scans with Nmap's `-T` options, is a specific technique not implied by the general context. Additionally, avoiding DNS resolution (`-n`) primarily prevents Nmap from performing reverse DNS lookups, which reduces network traffic and potential DNS server logs, but it does not alter the packets themselves in a way that directly evades an IDS/IPS's signature or anomaly detection.

Fragmentation, decoy, and source port spoofing

Why wrong: This option is incorrect because while fragmentation and decoy scanning are valid evasion techniques, source port spoofing (`-g` or `--source-port` in Nmap) is a distinct method not indicated. Source port spoofing involves sending packets from a specific or random source port to bypass firewall rules that might block common Nmap source ports or to confuse stateful firewalls, but it is not inherently part of the general evasion strategy implied without specific flags.

FTP (file transfer)

Why wrong: FTP (File Transfer Protocol) is an application-layer protocol used for transferring files between a client and server on a computer network. It defines the rules for data exchange, authentication, and session management, operating over TCP ports 20 and 21. DNS records, conversely, are database entries that map domain names to various types of information, such as IP addresses or mail servers, facilitating name resolution rather than direct service provision. Therefore, FTP itself is not a valid DNS record type.

HTTP (hypertext transfer)

Why wrong: HTTP (Hypertext Transfer Protocol) is an application-layer protocol used for transmitting hypermedia documents, such as HTML, across the internet. It defines how messages are formatted and transmitted, and what actions web servers and browsers should take in response to various commands. Unlike DNS records, which provide static mapping information for name resolution, HTTP is a communication protocol that operates *after* DNS has resolved a domain name to an IP address.

smb-enum-shares

Why wrong: The smb-enum-shares script is specifically designed for enumerating shared resources on Server Message Block (SMB) services, which are primarily used for file and printer sharing within local networks. While valuable for internal reconnaissance and identifying potential data exposure, this script operates at a different protocol layer and has no functional relevance to analyzing unusual outbound HTTPS traffic. It cannot detect a reverse shell attempting to blend in with web traffic, as its focus is entirely on SMB service configurations.

http-malware-host

Why wrong: The http-malware-host script is designed to scan a web server to determine if it is hosting or serving known malware. Its primary function is to identify malicious content *on a server*, typically by checking file hashes or content signatures against threat intelligence databases. Therefore, it would not detect a reverse shell, which typically involves a compromised client initiating an outbound connection to a command-and-control server, often using a legitimate-looking protocol like HTTPS, rather than a server serving malware.

ssh2-enum-algos

Why wrong: The ssh2-enum-algos script is used to identify the cryptographic algorithms supported by an SSH (Secure Shell) server, including those for key exchange, encryption, and message authentication codes. This reconnaissance tool targets SSH service configurations and is completely unrelated to the analysis of outbound HTTPS traffic. It provides no mechanism for detecting anomalies within TLS handshakes or identifying non-standard protocol negotiation indicative of a reverse shell masquerading as legitimate web traffic.

The target has a vulnerability in OpenSSH 7.4

Why wrong: Nmap's primary function with the -sV flag is service and version detection, not vulnerability scanning. While it can identify that OpenSSH 7.4 is running, it does not inherently assess whether that specific version contains known vulnerabilities. Determining actual vulnerabilities requires a dedicated vulnerability scanner or manual research against CVE databases, using Nmap's output as foundational information.

The target is vulnerable to the Heartbleed bug

Why wrong: The Heartbleed vulnerability specifically affected certain versions of OpenSSL, a cryptographic library, not the Apache HTTP server directly, although Apache often utilizes OpenSSL for HTTPS. Nmap's standard `-sV` scan identifies service versions but does not inherently test for specific vulnerabilities like Heartbleed. To detect this particular flaw, a specialized Nmap Scripting Engine (NSE) script, such as `ssl-heartbleed.nse`, would need to be explicitly executed.

The target is running a Linux-based operating system

Why wrong: The `-O` flag, included in the Nmap command `nmap ss sv o p 192 168 1 10`, instructs Nmap to attempt operating system detection by analyzing TCP/IP stack fingerprints. When Nmap successfully identifies services like OpenSSH and Apache, which are commonly found on Linux distributions, and combines this with its OS fingerprinting results, it can confidently infer that the target is running a Linux-based operating system.

Unknown

Why wrong: The 'Unknown' state is not a standard classification reported by Nmap. Nmap's design aims to provide specific, actionable intelligence regarding port accessibility and service presence, even for ambiguous scenarios. Instead of a generic 'unknown,' Nmap categorizes ports as 'filtered' if it cannot definitively determine their state due to network obstacles, or 'unfiltered' if it can reach the port but cannot determine if a service is listening.

Secured

Why wrong: The 'Secured' state is not a valid port state reported by Nmap. Nmap's port states describe the *reachability* and *responsiveness* of a port, indicating whether a service is listening or if a firewall is interfering. It does not assess the security posture, configuration strength, or authentication mechanisms of a service running on an open port; those are separate vulnerability assessment concerns beyond basic port scanning.

Blocked

Why wrong: The term 'Blocked' is not a specific port state reported by Nmap. While a firewall or network rule might 'block' traffic to a port, Nmap's technical classification for such a scenario is 'filtered.' This state explicitly indicates that an intermediary device is preventing Nmap from ascertaining the port's true status, rather than definitively stating the port is 'closed' on the target host itself.

nc -z <target> 25

Why wrong: The `-z` flag in Netcat is specifically designed for zero-I/O port scanning, meaning it attempts to establish a connection and immediately closes it without sending or receiving any data. While useful for quickly identifying open ports, this mode explicitly prevents the retrieval of service banners or any interactive communication. Therefore, it cannot be used to display the SMTP banner on port 25, as no data exchange occurs beyond the initial connection handshake.

nc -l -p 25

Why wrong: The `nc -l` command puts Netcat into listening mode, transforming it into a server that waits for incoming connections on the specified port. The `-p` flag, while often used with `-l` to define the listening port, does not change its fundamental server-side behavior. To connect to a remote target and retrieve its banner, Netcat must be used in client mode, not listening mode, as the goal is to initiate an outbound connection.

nc -u <target> 25

Why wrong: The `-u` flag explicitly instructs Netcat to use the User Datagram Protocol (UDP) for communication, rather than the default Transmission Control Protocol (TCP). SMTP, which typically operates on port 25, is a TCP-based service requiring a reliable, connection-oriented session. Attempting to connect to a TCP service using UDP will result in a failed connection and an inability to retrieve any service banner, as the protocols are fundamentally incompatible for this service.

Ping sweep

Why wrong: A ping sweep actively sends Internet Control Message Protocol (ICMP) echo request packets to a range of IP addresses to determine which hosts are alive. This method generates a distinct pattern of outbound ICMP traffic, which is easily detected and often blocked or logged by perimeter firewalls and network intrusion detection systems (NIDS), making it a noisy and non-stealthy reconnaissance technique.

ARP scan

Why wrong: An ARP scan operates exclusively within a local network segment by broadcasting Address Resolution Protocol (ARP) requests to resolve IP addresses to MAC addresses. While effective for discovering hosts on the immediate subnet, this technique generates significant broadcast traffic that is visible to all devices on the segment and cannot traverse routers, making it both localized and highly detectable within the local broadcast domain.

TCP SYN scan

Why wrong: A TCP SYN scan, also known as a half-open scan, sends a SYN packet to a target port and waits for a SYN/ACK response, but does not complete the three-way handshake. Although faster and less resource-intensive than a full connect scan, these unsolicited SYN packets are still actively sent to the target, generating network traffic that can be readily detected, logged, and potentially blocked by firewalls and intrusion detection systems (IDS) configured to identify port scanning attempts.

Telnet

Why wrong: Telnet is an application-layer protocol designed to provide a bidirectional interactive text-oriented communication facility using a virtual terminal connection. When used for banner grabbing, Telnet explicitly establishes a full TCP connection to the remote host and port, completing the three-way handshake before interacting with the service. This active, connection-oriented approach makes it unsuitable if the objective is to retrieve banners without initiating a full TCP connection.

Nmap with -sT

Why wrong: Nmap with the `-sT` flag performs a full TCP connect scan, which means it completes the entire three-way TCP handshake (SYN, SYN-ACK, ACK) for each probed port. While Nmap can retrieve banners using its Nmap Scripting Engine (NSE) with specific scripts (e.g., `banner` or `http-headers`), the `-sT` scan type itself inherently requires a full connection to determine port state, thus failing the condition of avoiding a full TCP connection.

Netcat

Why wrong: Netcat's primary function for banner grabbing involves actively establishing a full TCP connection to the target port. It initiates a complete three-way handshake (SYN, SYN-ACK, ACK) to connect to the service, then sends a request or waits for the service's initial greeting, which constitutes the banner. This active connection initiation directly violates any condition requiring the avoidance of a full TCP connection.

Enable DNS recursion on the name server

Why wrong: Enabling DNS recursion allows a name server to query other name servers on behalf of a client to resolve a query fully. While essential for many client lookups, it is entirely unrelated to the security of zone transfers, which involve the bulk transfer of DNS records. Furthermore, an open recursive resolver can be abused for DNS amplification attacks, making it a security vulnerability rather than a countermeasure.

Configure the name server to allow zone transfers from any host

Why wrong: Configuring a name server to allow zone transfers from any host, often referred to as an "open zone transfer," is a critical security vulnerability. This setting permits any client to request and receive a full copy of the domain's DNS records, including internal hostnames, IP addresses, and other sensitive network topology information. Such a misconfiguration provides attackers with a complete blueprint of the target network, greatly aiding reconnaissance and subsequent attack phases.

dns-zone-transfer

Why wrong: The dns-zone-transfer script attempts to perform a DNS zone transfer from a target DNS server. Its primary function is to enumerate all hostnames and IP addresses within a domain by requesting a full copy of the zone file. While a valid NSE script, its purpose is specifically for domain enumeration, not for identifying service versions or detecting vulnerabilities in general network services, which is the focus of the other correct options.

smb-os-discovery

Why wrong: The smb-os-discovery script is designed to gather detailed operating system information from remote hosts via the Server Message Block (SMB) protocol. It can identify the OS family, version, and even service pack levels. However, its specific function is OS fingerprinting, not the detection of application service versions (e.g., HTTP, SSL) or application-layer vulnerabilities, which are the focus of the other correct options.

Performing a SYN scan on the target

Why wrong: A SYN scan, often used for port scanning, involves sending TCP SYN packets to a target and waiting for a SYN/ACK or RST response. This direct interaction with the target system's network stack, where the scanner initiates communication and expects specific replies, constitutes active reconnaissance. It is not passive because it generates network traffic originating from the attacker and directed at the target, potentially alerting intrusion detection systems.

Sending a series of TCP packets with different flags and analyzing responses

Why wrong: Sending a series of specially crafted TCP packets with various flag combinations (e.g., FIN, PSH, URG, or no flags) and meticulously analyzing the target's responses is a hallmark of active OS fingerprinting. This method, exemplified by tools like Nmap's OS detection, directly probes the target's TCP/IP stack's unique implementation quirks. It requires initiating communication and eliciting specific, tailored reactions, making it an intrusive technique.

Using the telnet command to connect to port 80

Why wrong: Using the telnet command to connect to a specific port, such as port 80 for HTTP, is a form of active banner grabbing, not passive OS fingerprinting. This action establishes a direct TCP connection with the target service, prompting it to send its service banner, which often includes software version and sometimes OS information. This direct, interactive communication actively probes the service and is easily detectable by network monitoring tools.

Metasploit

Why wrong: Metasploit is a powerful penetration testing framework primarily designed for developing, testing, and executing exploits against remote target systems. While it can be used in later stages of a penetration test, its core functionality revolves around vulnerability exploitation, payload delivery, and post-exploitation activities, rather than passive information gathering from public sources. Therefore, it is not considered a common OSINT tool.

hping3

Why wrong: hping3 is a command-line oriented TCP/IP packet assembler/analyzer, primarily used for active network scanning, firewall testing, and port scanning. It constructs and sends custom packets to a target, eliciting responses that reveal network topology, firewall rules, and open ports. This direct interaction with the target system classifies it as an active reconnaissance tool, fundamentally distinct from passive OSINT methods.

Nmap

Why wrong: Nmap (Network Mapper) is a renowned open-source utility for network discovery and security auditing. It actively sends specially crafted packets to target hosts and analyzes their responses to determine available hosts, services, operating systems, and firewall configurations. Because Nmap directly interacts with the target network to gather information, it is categorized as an active reconnaissance tool, which is distinct from passive OSINT techniques that avoid direct engagement.

Increase the SOA refresh interval

Why wrong: Increasing the SOA (Start of Authority) refresh interval dictates how frequently secondary DNS servers query the primary server for updates to the zone's serial number. While important for maintaining replication consistency among legitimate servers, modifying this value does not inherently prevent unauthorized zone transfers. Malicious actors attempting to enumerate DNS records will typically initiate zone transfer requests regardless of the refresh interval, as this setting only governs scheduled updates for authorized secondaries, not security against unauthenticated access.

Disable recursive queries for external hosts

Why wrong: Disabling recursive queries for external hosts prevents the DNS server from performing lookups on behalf of clients outside its administrative domain. While its primary purpose is to mitigate DNS amplification attacks and prevent the server from being used as an open resolver, it indirectly enhances security by limiting the server's functionality to authoritative responses only. This reduction in attack surface makes the server less useful for reconnaissance by external attackers attempting to map network infrastructure via DNS, as it won't resolve arbitrary external queries.

Block all inbound traffic on UDP port 53

Why wrong: Blocking all inbound traffic on UDP port 53 would indeed prevent unauthorized zone transfers, but it would also render the DNS server completely inaccessible for legitimate DNS queries. Since DNS resolution relies heavily on UDP port 53 for standard queries, this action would effectively shut down the server's primary function. This makes it an impractical and counterproductive security measure that disrupts essential network services rather than securing them.

Performing SQL injection on a web application

Why wrong: Shodan is a passive reconnaissance tool that indexes banners and metadata from internet-connected devices, not an active exploitation platform. Performing SQL injection requires direct, interactive manipulation of a web application's input fields to exploit database vulnerabilities, a process fundamentally different from Shodan's passive data collection and search capabilities. Therefore, Shodan cannot be used to execute SQL injection attacks.

Sending phishing emails to employees of a target organization

Why wrong: Shodan is a network search engine focused on indexing information about internet-connected devices and services, not a platform for social engineering or direct communication. Sending phishing emails to employees requires access to email addresses and the capability to craft and deliver malicious messages, which are functionalities entirely outside of Shodan's scope. Shodan does not collect individual user data or possess email sending capabilities necessary for launching phishing campaigns.

Nmap

Why wrong: Nmap (Network Mapper) is an open-source utility primarily used for network discovery and security auditing. It actively sends packets to target hosts and analyzes their responses to identify open ports, running services, operating systems, and potential vulnerabilities. Its methodology involves direct network interaction, making it an active scanning tool rather than a passive OSINT tool designed for scraping public sources for email addresses.

Nessus

Why wrong: Nessus is a widely recognized, proprietary vulnerability scanner developed by Tenable. It performs comprehensive security assessments by actively probing target systems and networks for known vulnerabilities, misconfigurations, and missing patches. This active, intrusive scanning process involves direct interaction with the target environment to identify security flaws, which is fundamentally different from the passive collection of email addresses from publicly available information sources.

Shodan

Why wrong: Shodan is a unique search engine specifically designed to discover internet-connected devices and services, often referred to as the "search engine for the Internet of Things." It indexes banners and metadata from various network services (e.g., HTTP, FTP, SSH) across the globe, allowing users to find specific device types, open ports, and geographic locations. While it can reveal exposed services, its primary function is not to passively scrape public websites or databases for email addresses or subdomains in the manner of dedicated OSINT tools.

Perform a full TCP connect scan with UDP service detection on all ports

Why wrong: -sS is a SYN scan, not a full connect scan. -sV detects TCP service versions, not UDP. Not all ports are specified.

Perform an aggressive scan of all open ports and enumerate SMB shares

Why wrong: The -A flag enables aggressive mode (not used here). SMB enumeration requires specific scripts (--script smb-enum-shares). The specified ports do not include 445.

Perform a UDP scan on the four specified ports and identify running services

Why wrong: -sS is a TCP SYN scan, not a UDP scan. UDP scanning requires the -sU flag.

Nmap

Why wrong: Nmap is an active scanning tool that sends packets to the target, which would be considered active reconnaissance.

Netcat

Why wrong: Netcat is a networking utility used for banner grabbing or setting up listeners, but it actively connects to the target and is not a passive reconnaissance tool.

Wireshark

Why wrong: Wireshark is a packet sniffer that captures network traffic; while it can be passive, it requires existing traffic and does not specifically gather contact information.

The server is performing a DNS lookup to resolve the malicious IP address

Why wrong: DNS lookups use UDP/TCP port 53, not port 4444.

The web application is sending log data to a SIEM system for analysis

Why wrong: SIEM log forwarding typically uses ports like TCP/514 or TCP/1514, not 4444, and would not go to a known malicious IP.

The vulnerability scan caused a false positive and triggered a legitimate backup process

Why wrong: Backup processes typically use standard ports like TCP/443 or TCP/22, not high ports like 4444, and would not connect to a known malicious IP.

The DNS server is using DNSSEC to secure zone transfers

Why wrong: DNSSEC does not prevent AXFR; it provides data integrity and authentication but zone transfer restrictions are separate.

The DNS server is properly configured and only allows zone transfers to authorized secondary servers

Why wrong: If only authorized, the AXFR request would have been denied.

The target uses a split-DNS configuration with internal and external views

Why wrong: Split-DNS might restrict zone transfers, but a successful AXFR from an external perspective indicates a flaw.

site:admin login

Why wrong: The `site:` operator is designed to restrict search results to a specific domain or top-level domain (TLD), such as `site:example.com` or `site:.gov`. Using `site:admin` is syntactically incorrect for its intended purpose, as "admin" is not a valid domain. Consequently, this dork would not effectively filter for URLs containing "admin" or locate login pages, instead treating "admin" as a general keyword.

filetype:pdf admin login

Why wrong: The `filetype:` operator specifically targets documents of a particular format, such as PDF, DOCX, or XLSX. While `filetype:pdf admin login` would indeed locate PDF documents containing both "admin" and "login" keywords, it is entirely unsuitable for finding active web login pages or interfaces. This dork would retrieve static files, not dynamic web forms where a penetration tester would attempt authentication.

intitle:"login" inurl:admin

Why wrong: This dork correctly uses `inurl:admin` to find "admin" within the URL path. However, `intitle:"login"` restricts results to pages where the HTML `<title>` tag contains "login." While many login pages have "login" in their title, this combination does not specifically ensure that "login" also appears within the URL itself, which is a more direct indicator of a login *page* rather than just a page *about* logging in.