OSCP Network Scanning and Enumeration

Question 1

Which Nmap scan type sends TCP SYN packets and is often called a 'half-open' scan?

Accepted Answer

-sS (SYN scan)

Answer

-sT (TCP connect scan)

Answer

-sU (UDP scan)

Answer

-sA (ACK scan)

Question 2

What Nmap script category is most useful for initial service version detection during OSCP enumeration?

Accepted Answer

--script=default

Answer

--script=exploit

Answer

--script=auth

Answer

--script=vuln

Question 3

Which Nmap flag combination is commonly recommended for a comprehensive initial OSCP scan?

Accepted Answer

-sV -sC -p- -T4

Answer

-sT -O -F

Answer

-sN -sX -sF

Answer

-sU -sV --open

Question 4

What tool is best suited for enumerating SMB shares on a Windows target during an OSCP engagement?

Accepted Answer

enum4linux

Answer

dirb

Answer

gobuster

Answer

wfuzz

Question 5

Which command would you use with Nmap to enumerate SNMP services running on UDP port 161?

Accepted Answer

nmap -sU -p 161 --script=snmp-info <target>

Answer

nmap -sT -p 161 --script=snmp-brute <target>

Answer

nmap -sV -p 161 --script=http-info <target>

Answer

nmap -sS -p 161 --script=ftp-anon <target>

Question 6

What does the Nmap -A flag enable?

Accepted Answer

OS detection, version detection, script scanning, and traceroute

Answer

Anonymous login detection only

Answer

All UDP ports scan

Answer

Aggressive brute-force mode