OSCP Network Scanning and Enumeration 1 — Questions and Answers
Question 1: Which Nmap scan type sends TCP SYN packets and is often called a 'half-open' scan?
- -sT (TCP connect scan)
- -sS (SYN scan) (Correct answer)
- -sU (UDP scan)
- -sA (ACK scan)
Correct answer: -sS (SYN scan)
The -sS SYN scan sends a SYN packet and listens for a SYN-ACK without completing the three-way handshake, making it stealthier than a full connect scan.
Question 2: What Nmap script category is most useful for initial service version detection during OSCP enumeration?
- --script=exploit
- --script=auth
- --script=default (Correct answer)
- --script=vuln
Correct answer: --script=default
The 'default' script category runs commonly useful scripts that are safe, reliable, and provide helpful service information without being intrusive.
Question 3: Which Nmap flag combination is commonly recommended for a comprehensive initial OSCP scan?
- -sV -sC -p- -T4 (Correct answer)
- -sT -O -F
- -sN -sX -sF
- -sU -sV --open
Correct answer: -sV -sC -p- -T4
The combination -sV -sC -p- -T4 scans all 65535 ports with service version detection and default scripts at an aggressive timing template.
Question 4: What tool is best suited for enumerating SMB shares on a Windows target during an OSCP engagement?
- dirb
- enum4linux (Correct answer)
- gobuster
- wfuzz
Correct answer: enum4linux
Enum4linux is a tool for enumerating information from Windows and Samba systems, including shares, users, groups, and password policies.
Question 5: Which command would you use with Nmap to enumerate SNMP services running on UDP port 161?
- nmap -sU -p 161 --script=snmp-info <target> (Correct answer)
- nmap -sT -p 161 --script=snmp-brute <target>
- nmap -sV -p 161 --script=http-info <target>
- nmap -sS -p 161 --script=ftp-anon <target>
Correct answer: nmap -sU -p 161 --script=snmp-info <target>
SNMP runs on UDP port 161, so you must use -sU for a UDP scan combined with the snmp-info script to enumerate SNMP information.
Question 6: What does the Nmap -A flag enable?
- Anonymous login detection only
- OS detection, version detection, script scanning, and traceroute (Correct answer)
- All UDP ports scan
- Aggressive brute-force mode
Correct answer: OS detection, version detection, script scanning, and traceroute
The -A flag enables aggressive mode, which combines OS detection (-O), version scanning (-sV), script scanning (-sC), and traceroute in a single flag.
OSCP Network Scanning and Enumeration 1
Which Nmap scan type sends TCP SYN packets and is often called a 'half-open' scan?