eJPT Scanning and Enumeration 5 — Questions and Answers
Question 1: What does the Nmap '--script=vuln' option do during a scan?
- Generates a vulnerability report from saved scan data
- Runs NSE scripts in the 'vuln' category to check for known vulnerabilities (Correct answer)
- Exploits discovered vulnerabilities automatically
- Scans only ports associated with vulnerable services
Correct answer: Runs NSE scripts in the 'vuln' category to check for known vulnerabilities
The 'vuln' NSE category contains scripts that probe services for specific known vulnerabilities without exploiting them.
Question 2: Which tool can be used to enumerate valid usernames on a Linux system by exploiting the 'finger' service (port 79)?
- finger (native command) (Correct answer)
- enum4linux
- rpcclient
- smtp-user-enum
Correct answer: finger (native command)
The native 'finger' command queries the finger daemon to retrieve user information including login name, full name, and idle time.
Question 3: During an eJPT exam scenario, you want to find all hosts with port 80 open in the 10.10.10.0/24 subnet quickly. Which Nmap command is best?
- nmap -sV 10.10.10.0/24
- nmap -p 80 --open 10.10.10.0/24 (Correct answer)
- nmap -A 10.10.10.0/24
- nmap -sU -p 80 10.10.10.0/24
Correct answer: nmap -p 80 --open 10.10.10.0/24
'-p 80 --open' restricts the scan to port 80 and only displays hosts where it's open, making results fast and clean.
Question 4: What is the primary purpose of running 'rpcclient -U "" -N <target>' during Windows enumeration?
- Exploit a remote code execution vulnerability via RPC
- Connect anonymously to the RPC service to enumerate users and shares (Correct answer)
- Brute-force RPC credentials
- Capture NTLM hashes via RPC relay
Correct answer: Connect anonymously to the RPC service to enumerate users and shares
rpcclient with an empty username and -N (no password) attempts a null session to enumerate domain users, shares, and groups via MS-RPC.
Question 5: Which HTTP response code confirms that a directory or file found during web enumeration actually exists on the server?
- 301 Moved Permanently
- 404 Not Found
- 200 OK (Correct answer)
- 403 Forbidden
Correct answer: 200 OK
A 200 OK response means the server successfully located and returned the requested resource, confirming its existence.
Question 6: In the context of eJPT scanning, what is 'banner grabbing' used for?
- Intercepting authentication cookies from web responses
- Capturing service banners to identify software name and version (Correct answer)
- Downloading the web server's home page content
- Grabbing SSL certificate information only
Correct answer: Capturing service banners to identify software name and version
Banner grabbing reads the text a service sends upon connection, often revealing the application name, version, and sometimes OS details.
Question 7: Which command using Nmap's NSE would specifically check if an SMB target is vulnerable to EternalBlue (MS17-010)?
- nmap --script=smb-vuln-ms17-010 <target> (Correct answer)
- nmap --script=smb-brute <target>
- nmap --script=http-shellshock <target>
- nmap --script=ftp-anon <target>
Correct answer: nmap --script=smb-vuln-ms17-010 <target>
The 'smb-vuln-ms17-010' NSE script probes SMB to determine if the host is missing the MS17-010 patch and is vulnerable to EternalBlue.
eJPT Scanning and Enumeration 5
What does the Nmap '--script=vuln' option do during a scan?