OSCP Network Scanning and Enumeration 2 — Questions and Answers
Question 1: Which tool is used to perform DNS zone transfer attacks during OSCP reconnaissance?
- dig axfr (Correct answer)
- nslookup -type=A
- host -t MX
- whois -d
Correct answer: dig axfr
The command 'dig axfr @<nameserver> <domain>' requests a full DNS zone transfer, which can reveal all DNS records if the server is misconfigured.
Question 2: During an OSCP lab, you find port 111 open on a Linux target. What service is most likely running?
- HTTP proxy
- Portmapper/RPC (Correct answer)
- DNS resolver
- LDAP directory
Correct answer: Portmapper/RPC
Port 111 is used by the Portmapper (rpcbind) service, which maps RPC program numbers to network port numbers and is commonly found on Linux/Unix systems.
Question 3: What is the purpose of the 'rpcinfo -p <target>' command during enumeration?
- Enumerate all RPC services and their port numbers on the target (Correct answer)
- Perform a remote password reset via RPC
- Scan all open UDP ports
- List all running processes on the target
Correct answer: Enumerate all RPC services and their port numbers on the target
The 'rpcinfo -p' command queries the portmapper and lists all registered RPC programs, their versions, protocol, and the ports they are listening on.
Question 4: Which Nmap timing template (-T) value provides the most aggressive scan speed?
- -T2
- -T3
- -T5 (Correct answer)
- -T4
Correct answer: -T5
The -T5 'insane' timing template is the most aggressive, sending packets as fast as possible at the risk of missing results due to network congestion.
Question 5: What tool would you use to brute-force directory and file names on a web server during OSCP?
- enum4linux
- gobuster (Correct answer)
- responder
- bloodhound
Correct answer: gobuster
Gobuster is a tool used to brute-force URIs (directories and files), DNS subdomains, and virtual host names using wordlists.
Question 6: When enumerating NFS shares during OSCP, which command shows available exports on a target?
- showmount -e <target> (Correct answer)
- nfsstat -m <target>
- mount -t nfs <target>:/
- rpcinfo --list <target>
Correct answer: showmount -e <target>
The 'showmount -e' command queries the NFS server and displays its list of exported directories along with any access restrictions.
OSCP Network Scanning and Enumeration 2
Which tool is used to perform DNS zone transfer attacks during OSCP reconnaissance?