CEH Footprinting, Reconnaissance and Scanning Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Sending TCP SYN packets and analyzing responses

  Why it's wrong here

  Sending TCP SYN packets directly to a target system is an active OS fingerprinting technique because it involves initiating new network connections. This process requires the attacker to transmit data to the target and then analyze the specific characteristics of the SYN-ACK or RST responses received, such as TCP options, initial window size, and sequence numbers, which are unique to different operating systems. This direct probing distinguishes it from passive methods that merely observe existing traffic.

• ✓

  Analyzing TTL and window size from captured packets

  Why this is correct

  Analyzing the Time-To-Live (TTL) and TCP window size fields from packets already captured from network traffic is a classic passive OS fingerprinting method. This technique does not involve sending any new packets to the target system; instead, it infers the operating system by examining the initial TTL values (which decrement per hop) and the advertised TCP window sizes, both of which often have distinct default values across different OS implementations. By observing these characteristics in legitimate, ongoing communications, an attacker can identify the OS without direct interaction.

• ✗

  Performing a NULL scan

  Why it's wrong here

  Performing a NULL scan is an active OS fingerprinting technique because it involves deliberately crafting and sending TCP packets to a target port. In a NULL scan, all TCP flag bits (SYN, ACK, RST, FIN, PSH, URG) are set to zero, and the system then analyzes the target's response or lack thereof. The target's reaction (e.g., sending an RST for closed ports on most OSes, or no response for open ports on some) provides clues about its operating system and port state, requiring direct interaction with the host.

• ✗

  Using Nmap -O flag

  Why it's wrong here

  Utilizing Nmap with the "-O" flag for OS detection is a highly active fingerprinting method, as it systematically sends a series of specialized TCP, UDP, and ICMP probes to the target system. Nmap then meticulously analyzes the responses to these probes, examining numerous characteristics such as initial TCP window size, SYN/ACK options, IP ID sequence generation, and ICMP error message details. This extensive probing and response analysis allows Nmap to build a highly accurate OS signature, but it undeniably involves direct and detectable interaction with the target.

Go deeper

Related to this question