Hands-on Ethical Hacking and Network Defense, 3e, ISBN 9781285454610
Ch. 5 Solutions-1
Chapter 5 Solutions
Review Questions
1. Security testers and hackers use which of the following to determine the services running
on a host and the vulnerabilities associated with these services?
2. What is the most widely used port-scanning tool?
3. To find extensive Nmap information and examples of the correct syntax to use in Linux,
which of the following commands should you type?
4. To see a brief summary of Nmap commands in a Linux shell, which of the following
should you do?
5. Which of the following Nmap commands sends a SYN packet to a computer with the IP
address 193.145.85.210? (Choose all that apply.)
6. Which flags are set on a packet sent with the nmap -sX 193.145.85.202
command? (Choose all that apply.)
7. Which Nmap command verifies whether the SSH port is open on any computers in the
192.168.1.0 network? (Choose all that apply.)
8. A closed port responds to a SYN packet with which of the following packets?
9. Which parameter can be added to nmap to run a script scan with the default scripts?
10. Security testers can use Hping to bypass filtering devices. True or False?
11. A FIN packet sent to a closed port responds with which of the following packets?
12. A(n) ________ scan sends a packet with all flags set to NULL.
13. What is a potential mistake when performing a ping sweep on a network?
Hands-on Ethical Hacking and Network Defense, 3e, ISBN 9781285454610
Ch. 5 Solutions-2
14. Port scanning provides the state for all but which of the following ports?
15. A NULL scan requires setting the FIN, ACK, and URG flags. True or False?
16. Why does the fping -f 193.145.85.201 193.145.85.220 command cause
an error?
17. In basic network scanning, ICMP Echo Requests (type 8) are sent to host computers from
the attacker, who waits for which type of packet to confirm that the host computer is live?
18. To bypass some ICMP-filtering devices on a network, an attacker might send which type
of packets to scan the network for vulnerable services? (Choose all that apply.)
19. Which of the following is a tool for creating a custom TCP/IP packet and sending it to a
host computer?
20. Fping doesn’t allow pinging multiple IP addresses simultaneously. True or False?
Activities
Activity 5-1: Getting to Know Nmap
Step 2: -sS (SYN port scan), -sU (UDP port scan), -sP (ping scan), and so forth
Activity 5-2: Using Additional Nmap Commands
Step 2: -sC will invoke nmap script engine. The command is nmap 136.142.35.137 –sC.
Activity 5-3: Crafting Packets with Fping and Hping
Hands-on Ethical Hacking and Network Defense, 3e, ISBN 9781285454610
Ch. 5 Solutions-3
Activity 5-4: Creating an Executable Shell Script
Case Projects
Case Project 5-1: Gathering Information on a Network’s Active Services
The memo should show how a scan (SYN, ACK, NULL, and so forth) can indicate which service
is running on a computer or server and explain how knowledge of that service can guide testers to
exploits that might be used to attack the service or port. Students can use keywords to search the
OSSTMM document on the book’s DVD for information. They should be familiar with navigating
through this document, and the information can assist in generating discussions on many security
topics. For example, the “Identifying Services” section contains the following topics, which can be
included in the memo:
1. Match each open port to a service and protocol.
3. Verify the application’s system and version.
Case Project 5-2: Finding Port-Scanning Tools