Chapter 5: Reconnaissance and Intelligence Gathering

Megan wants to use the Metasploit Framework to conduct a web application vulnerability scan. What module from the following list is best suited to her needs?

• 1. smb_login

• 1. Angry IP

• 1. nmap

• 1. wmap

Answer explanation

The wmap scanner is a web application scanner module for the Metasploit Framework that can scan for vulnerable web applications. The smb_login tool looks for SMB shares, not web applications. Angry IP Scanner is not integrated with Metasploit, and nmap is a port scanner, not a full web application vulnerability scanner.

What flag does nmap use to enable operating system identification?

• 1. –os

• 1. –id

• 1. –O

• 1. –osscan

Answer explanation

Nmap's operating system identification flag is –O and it enables OS detection. –A also enables OS identification and other features. –osscan with modifiers like –limit and –guess set specific OS identification features. –os and –id are not nmap flags.

What command-line tool can be used to determine the path that traffic takes to a remote system?

• 1. Whois

• 1. traceroute

• 1. nslookup

• 1. routeview

Answer explanation

Traceroute (or tracert on Windows systems) is a command-line tool that uses ICMP to trace the route that a packet takes to a host. Whois and nslookup are domain tools, and routeview is not a command-line tool.

Valerie wants to use a graphical interface to control nmap and wants to display her scans as a visual map to help her understand her target networks. What tool from the following list should she use?

• 1. Angry IP Scanner

• 1. wmap

• 1. Zenmap

• 1. nmap-gs

Answer explanation

Zenmap is a graphical user interface for nmap that also supports graphical output, including visual maps of networks. Valerie can use Zenmap to control nmap and create the output she wants. Angry IP Scanner is a separate scanner and does not generate a visual map of networks—instead, it provides lists. Wmap is a plug-in for the Metasploit Framework and a stand-alone tool that is a web application and service vulnerability testing tool, and nmap-gs was made up for this question.

Susan runs an nmap scan using the following command: nmap -O -Pn 192.168.1.0/255

What information will she see about the hosts she scans?

• 1. The hostname and service ports

• 1. The hostname, service ports, and operating system

• 1. The hostname and operating system

• 1. The hostname, uptime, and logged-in user

Answer explanation

Along with the time to run the scan and time to live of packets sent, Susan will see the hostname, service ports, and operating system using the scan flags above. The -O flag attempts to identify the operating system, while the -Pn flag skips pinging and scans all hosts in the network on their typically scanned ports.

Tuan wants to gather additional information about a domain that he has entered in Maltego. What functionality is used to perform server-based actions in Maltego?

• 1. A worker

• 1. A query

• 1. A transform

• 1. A scan

Answer explanation

Maltego calls its server-based functions for information gathering “transforms.”

Laura wants to conduct a search for hosts using Recon-ng but wants to leverage a search engine with API access to acquire existing data. What module should she use?

• 1. recon/companies-multi/whois_miner

• 1. import/nmap

• 1. recon/domains-hosts/shodan_hostname

• 1. import/list

Answer explanation

While you may not know the full list of Recon-ng plug-ins, Shodan is a well-known search engine. Laura could leverage API access to Shodan to gather information from previously performed searches. Both the import utilities will require her to have data she has already gathered, and the Whois miner can be assumed to use Whois information rather than an existing search engine dataset.

After running an nmap scan, Geoff sees ports 80 and 443 open on a system he scanned. What reasonable guess can he make about the system based on this result?

• 1. The system is a Windows system.

• 1. The system is running a database server.

• 1. The system is a Linux system.

• 1. The system is running a web server.

Answer explanation

Ports 80 and 443 are commonly associated with unencrypted (port 80) and TLS encrypted (port 443) web servers. There is not enough information to determine if this might be a Windows or Linux system, and these are not typical ports for a database server.

What information is used to identify network segments and topology when conducting an nmap scan?

• 1. IP addresses

• 1. Hostnames

• 1. Time to live

• 1. Port numbers

Answer explanation

The time to live (TTL) provided as part of responses is used to evaluate the number of hops in a network, and thus to derive a best guess at network topology. While IP addresses can sometimes be related to network topology, they're less likely to be directly associated with it. Hostnames and port numbers have no correlation to topology.

Murali wants to scan a network using nmap and has run a scan without any flags without discovering all of the hosts that he thinks should show. What scan flag can he use to scan without performing host discovery that will also determine if services are open on the systems?

• 1. -sn

• 1. -PS

• 1. -Pn

• 1. -sL

Answer explanation

The -Pn, or “no ping”, flag skips host discovery and performs a port scan. The -sn flag skips the port scan after discovery, sL lists hosts by performing DNS lookups, and -PS performs probes using a TCP SYN.