eJPT Scanning and Enumeration 4 — Questions and Answers
Question 1: Which Nmap flag enables the use of decoy addresses to obscure the true source of a scan?
- -D (Correct answer)
- -S
- -e
- -f
Correct answer: -D
The '-D <decoy1,decoy2,...,ME>' option makes the scan appear to originate from multiple IP addresses, hiding the real source.
Question 2: When enumerating a web application, what does directory brute-forcing with Gobuster primarily accomplish?
- Cracks user passwords stored in web config files
- Discovers hidden or unlisted directories and files on a web server (Correct answer)
- Exploits SQL injection vulnerabilities
- Intercepts and modifies HTTP requests in transit
Correct answer: Discovers hidden or unlisted directories and files on a web server
Gobuster systematically requests paths from a wordlist to find directories and files the server doesn't publicly link to.
Question 3: What is the significance of TCP port 3389 discovered open on a target?
- VNC remote desktop service
- Windows Remote Desktop Protocol (RDP) (Correct answer)
- SSH secure shell
- Telnet remote access
Correct answer: Windows Remote Desktop Protocol (RDP)
Port 3389 is the default port for Microsoft's Remote Desktop Protocol (RDP), allowing GUI-based remote access to Windows hosts.
Question 4: Which scanning technique is used to bypass simple stateless firewalls by sending a TCP packet with only the FIN flag set?
- SYN scan
- FIN scan (Correct answer)
- XMAS scan
- Null scan
Correct answer: FIN scan
A FIN scan sends packets with only the FIN flag, which some stateless firewalls pass because they don't match a SYN rule, while closed ports respond with RST.
Question 5: What information can 'nbtscan' retrieve from a Windows host on a local network?
- Open TCP ports and service banners
- NetBIOS names, MAC addresses, and workgroup/domain names (Correct answer)
- Active directory user list
- Installed software versions
Correct answer: NetBIOS names, MAC addresses, and workgroup/domain names
nbtscan sends NetBIOS Name Service queries to retrieve computer names, logged-in users, and workgroup/domain membership.
Question 6: During a pentest, you discover port 25 open on a target server. Which protocol and service does this indicate?
- FTP file transfer
- SMTP email service (Correct answer)
- POP3 email retrieval
- DNS name resolution
Correct answer: SMTP email service
TCP port 25 is the default port for SMTP (Simple Mail Transfer Protocol), used to send and relay email messages.
Question 7: Which Nmap timing template balances speed and accuracy and is recommended for most standard penetration tests?
- -T1 (Sneaky)
- -T3 (Normal)
- -T4 (Aggressive) (Correct answer)
- -T5 (Insane)
Correct answer: -T4 (Aggressive)
'-T4' (Aggressive) speeds up scans significantly while remaining reliable, making it the most commonly recommended template for authorized pentests.
eJPT Scanning and Enumeration 4
Which Nmap flag enables the use of decoy addresses to obscure the true source of a scan?