Vulnerability Assessment Tools & Techniques Flashcards

Which Nmap scan type sends a SYN packet and waits for a SYN-ACK without completing the three-way handshake?

Answer: SYN stealth scan (-sS)

SYN stealth scan (-sS) sends a SYN packet and tears down the connection after receiving SYN-ACK, leaving no completed TCP session in logs.

What is the primary purpose of the Metasploit Framework's 'auxiliary' modules?

Answer: Scanning, fuzzing, and information gathering without exploitation

Auxiliary modules perform support tasks such as scanning, fuzzing, sniffing, and banner grabbing without launching an exploit against a target.

A vulnerability assessor needs to identify open ports on a target that blocks ICMP. Which Nmap technique is MOST appropriate?

Answer: TCP SYN scan with ICMP disabled (-Pn)

Using -Pn tells Nmap to skip host discovery and scan ports directly, bypassing ICMP-blocking firewalls.

Which tool is specifically designed to identify web application vulnerabilities such as SQL injection and XSS through automated crawling?

Answer: Nikto

Nikto is an open-source web server scanner that tests for dangerous files, misconfigurations, and common web vulnerabilities including SQL injection and XSS.

In the context of vulnerability scanning, what does a 'false positive' result mean?

Answer: The scanner reports a vulnerability that does not actually exist

A false positive occurs when a scanner flags a condition as a vulnerability when the system is not actually vulnerable, requiring manual verification.

Which OWASP tool is used for intercepting and modifying HTTP/HTTPS traffic between a browser and web application?

Answer: OWASP ZAP

OWASP ZAP (Zed Attack Proxy) acts as a man-in-the-middle proxy to intercept, inspect, and modify web traffic for security testing.

What is 'credentialed scanning' and why is it preferred in vulnerability assessments?

Answer: Providing the scanner with login credentials to perform deeper internal checks

Credentialed scanning provides the scanner with valid credentials so it can log into systems and audit installed software, patches, and configurations from the inside.