OSCP Network Scanning and Enumeration 2

Question 1

Which tool is used to perform DNS zone transfer attacks during OSCP reconnaissance?

Accepted Answer

dig axfr

Answer

The command 'dig axfr @ ' requests a full DNS zone transfer, which can reveal all DNS records if the server is misconfigured.

Question 2

During an OSCP lab, you find port 111 open on a Linux target. What service is most likely running?

Accepted Answer

Portmapper/RPC

Answer

Port 111 is used by the Portmapper (rpcbind) service, which maps RPC program numbers to network port numbers and is commonly found on Linux/Unix systems.

Question 3

What is the purpose of the 'rpcinfo -p <target>' command during enumeration?

Accepted Answer

Enumerate all RPC services and their port numbers on the target

Answer

The 'rpcinfo -p' command queries the portmapper and lists all registered RPC programs, their versions, protocol, and the ports they are listening on.

Question 4

Which Nmap timing template (-T) value provides the most aggressive scan speed?

Accepted Answer

-T5

Answer

The -T5 'insane' timing template is the most aggressive, sending packets as fast as possible at the risk of missing results due to network congestion.

Question 5

What tool would you use to brute-force directory and file names on a web server during OSCP?

Accepted Answer

gobuster

Answer

Gobuster is a tool used to brute-force URIs (directories and files), DNS subdomains, and virtual host names using wordlists.

OSCP - Offensive Security Certified Professional Practice Test

OSCP - Offensive Security Certified Professional Practice Test

OSCP Network Scanning and Enumeration 2