eJPT - eLearnSecurity Junior Penetration Tester Scanning and Enumeration Questions and Answers — Questions and Answers
Question 1: A penetration tester runs an Nmap scan with the command `nmap -sS 192.168.1.10`. What is the primary characteristic of this type of scan?
- It uses UDP packets to identify open ports.
- It completes the full TCP three-way handshake.
- It is a stealth scan that does not complete the TCP three-way handshake. (Correct answer)
- It aggressively queries all 65,535 TCP ports by default.
Correct answer: It is a stealth scan that does not complete the TCP three-way handshake.
The `-sS` flag in Nmap specifies a TCP SYN scan, also known as a 'stealth' or 'half-open' scan. It initiates a TCP connection by sending a SYN packet but does not complete the three-way handshake, making it less likely to be logged by the target system.
Question 2: During an engagement, you suspect a misconfigured DNS server might leak information about the internal network structure. Which technique would be most effective for attempting to retrieve all DNS records from the server?
- Brute-forcing subdomains using a common wordlist.
- Performing a TCP Connect scan on port 53.
- Sending an ICMP echo request to the DNS server.
- Attempting a DNS Zone Transfer (AXFR). (Correct answer)
Correct answer: Attempting a DNS Zone Transfer (AXFR).
A DNS Zone Transfer (AXFR) is a mechanism for replicating DNS databases across a set of DNS servers. If a server is misconfigured to allow zone transfers to any client, an attacker can use this to request and receive a copy of all DNS records for a zone, revealing the internal network structure.
Question 3: A penetration tester needs to gather as much information as possible from a Windows host over SMB, including users, shares, and password policies. Which of the following tools is specifically designed for this purpose?
- Netcat
- Wireshark
- Enum4linux (Correct answer)
- Hydra
Correct answer: Enum4linux
Enum4linux is a tool specifically created to enumerate information from Windows and Samba systems over the SMB protocol. It can gather data such as user lists, group memberships, shares, and password policies.
Question 4: While scanning a target, you want to identify the specific version of the software running on an open port to search for known vulnerabilities. Which Nmap command-line option would you use to achieve this?
- -O
- -A
- -sV (Correct answer)
- -p-
Correct answer: -sV
The `-sV` option in Nmap enables version detection. It probes open ports to determine service and version information, which is crucial for identifying potentially vulnerable software.
Question 5: A junior penetration tester is tasked with enumerating SNMP on a network device at 10.10.5.25. They discover that the default read community string is set to 'public'. What kind of information can they likely obtain?
- The private SSH keys for the device administrator.
- The ability to modify the device's running configuration.
- System information such as routing tables, hostnames, and user accounts. (Correct answer)
- Encrypted password hashes from the /etc/shadow file.
Correct answer: System information such as routing tables, hostnames, and user accounts.
With a default read-only community string like 'public', an attacker can use SNMP enumeration tools (like snmpwalk or nmap's snmp scripts) to query the device's Management Information Base (MIB). This can reveal a wealth of information, including system uptime, network interfaces, user accounts, running processes, and routing tables.
Question 6: Which of the following describes the purpose of 'banner grabbing' during the enumeration phase?
- To capture and analyze network traffic packets.
- To connect to an open port to receive the introductory text or 'banner' sent by the service, often revealing its type and version. (Correct answer)
- To perform a denial-of-service attack by sending a malicious banner to a service.
- To identify the physical location of a server based on its network banner.
Correct answer: To connect to an open port to receive the introductory text or 'banner' sent by the service, often revealing its type and version.
Banner grabbing is a technique used to connect to a service on an open port and read the initial text-based 'banner' it sends. This banner often contains details about the service name and version, which is valuable information for a penetration tester looking for potential vulnerabilities.
eJPT - eLearnSecurity Junior Penetration Tester Scanning and Enumeration Questions and Answers
A penetration tester runs an Nmap scan with the command `nmap -sS 192.168.1.10`.
What is the primary characteristic of this type of scan?