OSCP Network Scanning and Enumeration

Question 1

Which Nmap scan type sends TCP SYN packets and is often called a 'half-open' scan?

Accepted Answer

-sS (SYN scan)

Answer

The -sS SYN scan sends a SYN packet and listens for a SYN-ACK without completing the three-way handshake, making it stealthier than a full connect scan.

Question 2

What Nmap script category is most useful for initial service version detection during OSCP enumeration?

Accepted Answer

--script=default

Answer

The 'default' script category runs commonly useful scripts that are safe, reliable, and provide helpful service information without being intrusive.

Question 3

Which Nmap flag combination is commonly recommended for a comprehensive initial OSCP scan?

Accepted Answer

-sV -sC -p- -T4

Answer

The combination -sV -sC -p- -T4 scans all 65535 ports with service version detection and default scripts at an aggressive timing template.

Question 4

What tool is best suited for enumerating SMB shares on a Windows target during an OSCP engagement?

Accepted Answer

enum4linux

Answer

Enum4linux is a tool for enumerating information from Windows and Samba systems, including shares, users, groups, and password policies.

Question 5

Which command would you use with Nmap to enumerate SNMP services running on UDP port 161?

Accepted Answer

nmap -sU -p 161 --script=snmp-info <target>

Answer

SNMP runs on UDP port 161, so you must use -sU for a UDP scan combined with the snmp-info script to enumerate SNMP information.

OSCP - Offensive Security Certified Professional Practice Test

OSCP - Offensive Security Certified Professional Practice Test

OSCP Network Scanning and Enumeration