Certified Ethical Hacker (CEH) Scanning, Enumeration, and Vulnerability Analysis Syllabus

Scanning, Enumeration, and Vulnerability Analysis syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Scanning, Enumeration, and Vulnerability Analysis in Certified Ethical Hacker (CEH), not a summary of it.

1. 1

   Network Scanning

   5 topics

   • Host Discovery Techniques
     • ICMP, ARP, and UDP ping sweeps
     • Live host identification
   • Port and Service Scanning
     • TCP connect, SYN stealth, and full-open scans
     • FIN, NULL, Xmas, and ACK scans
     • UDP scanning and idle/zombie scan
   • Banner Grabbing and OS Fingerprinting
     • Active vs passive OS fingerprinting
     • Service and version detection
   • Evading IDS and Firewalls During Scanning
     • Packet fragmentation and source spoofing
     • Decoy scanning and timing manipulation
   • Scanning Tools
     • Nmap and NSE scripting
     • Hping3, Masscan, and Unicornscan
2. 2

   Enumeration

   5 topics

   • Enumeration Concepts
     • Techniques and default ports enumerated
   • NetBIOS, SMB, and SNMP Enumeration
     • NetBIOS name and share enumeration
     • SNMP MIB walking and community strings
   • LDAP, NTP, and NFS Enumeration
     • LDAP directory enumeration
     • NTP and NFS share enumeration
   • DNS, SMTP, and Other Service Enumeration
     • DNS cache snooping and zone transfer
     • SMTP VRFY/EXPN/RCPT enumeration
   • Enumeration Countermeasures
3. 3

   Vulnerability Analysis

   4 topics

   • Vulnerability Assessment Concepts
     • Types: active, passive, internal, external
     • Assessment lifecycle
   • Scoring Systems and Databases
     • CVSS scoring metrics
     • CVE, NVD, CWE databases
   • Vulnerability Scanning Tools
     • Nessus, OpenVAS, Qualys, Nikto
   • Assessment Reports and Remediation

Scanning, Enumeration, and Vulnerability Analysis flashcards for Certified Ethical Hacker (CEH)

22 of 51 cards from the Scanning, Enumeration, and Vulnerability Analysis deck — real questions with worked answers.

1. What is the purpose of host discovery (network scanning) in the scanning phase?

   To identify which hosts on a target network are live/active and reachable, building a list of reachable IP addresses before deeper port and service scanning.

2. Which scan type uses ICMP Echo Request (Type 8) / Echo Reply (Type 0) to determine if a host is alive?

   An ICMP ECHO ping (ping sweep). The scanner sends Echo Requests; live hosts reply with Echo Reply.

3. What is an ARP ping scan and when is it most reliable?

   It sends ARP requests to discover live hosts; it is highly reliable and fast on a local subnet/LAN because hosts must answer ARP, and it cannot be blocked the way ICMP often is.

4. In Nmap, which flag performs host discovery only (a ping scan) without port scanning?

   -sn (formerly -sP) performs a ping scan / no port scan, listing only which hosts are up.

5. How does a TCP SYN (half-open / stealth) scan work, and why is it called 'half-open'?

   The scanner sends a SYN; an open port replies SYN/ACK and the scanner sends RST instead of completing the handshake. The connection is never fully established, so it is 'half-open' and less likely to be logged.

6. In a TCP SYN scan, what response indicates an OPEN port versus a CLOSED port?

   Open port: SYN/ACK response. Closed port: RST (RST/ACK) response. No response or ICMP unreachable suggests filtered.

7. How does a TCP Connect scan differ from a SYN scan?

   A Connect scan (Nmap -sT) completes the full three-way handshake (SYN, SYN/ACK, ACK) using the OS connect() call. It is more reliable but slower and more easily logged than the half-open SYN scan.

8. In FIN, NULL, and Xmas scans, what response distinguishes an open (or filtered) port from a closed port?

   Closed port returns RST. Open/filtered port returns no response. These scans exploit RFC 793 behavior and do not work reliably against Windows hosts.

9. Which TCP flags are set in an Xmas scan?

   FIN, PSH, and URG flags are all set (the packet is 'lit up like a Christmas tree').

10. What characterizes a NULL scan?

    A TCP packet sent with no flags set at all; closed ports reply RST, open/filtered ports give no response. It only works on RFC 793-compliant (non-Windows) stacks.

11. What is an ACK flag probe scan primarily used to detect?

    Firewall rule sets / filtering state — it does not determine open vs closed ports, but distinguishes filtered (stateful firewall, no response or ICMP) from unfiltered (RST returned) ports.

12. What is an IDLE/IPID scan and what is its main advantage?

    A scan that uses a 'zombie' host's predictable IP ID sequence to probe a target so the target sees scans coming from the zombie, not the attacker. Advantage: it is fully blind/stealthy, hiding the attacker's true source IP.

13. Which scan technique is used to probe UDP ports, and how are open vs closed UDP ports inferred?

    A UDP scan (Nmap -sU). Closed UDP port returns ICMP Port Unreachable (Type 3, Code 3). Open or filtered ports typically give no response, making UDP scanning slow and less certain.

14. What is banner grabbing and what two types exist?

    Banner grabbing is fingerprinting that captures service banners to identify the application, version, and OS. Active banner grabbing sends crafted packets and analyzes replies; passive banner grabbing sniffs traffic / error messages without direct interaction.

15. What is the difference between active and passive OS fingerprinting?

    Active fingerprinting sends specially crafted packets and analyzes the responses (TTL, window size, etc.). Passive fingerprinting only sniffs existing traffic, making it stealthier but slower and less precise.

16. Which four TCP/IP fields are commonly analyzed for OS fingerprinting?

    TTL (Time To Live), TCP Window Size, DF (Don't Fragment) bit, and TOS (Type of Service). Different OSes use characteristic default values.

17. What default TTL values typically indicate Linux/Unix versus Windows hosts?

    Linux/Unix commonly use a default TTL of 64; Windows commonly uses 128; many Cisco/network devices use 255.

18. Which Nmap option enables service/version detection and which enables OS detection?

    -sV enables service and version detection (banner grabbing); -O enables OS detection/fingerprinting. -A enables aggressive scan (OS, version, scripts, traceroute).

19. Name three common techniques used to evade IDS/IPS and firewalls during scanning.

    Packet fragmentation, source IP spoofing / decoy scanning, and source port manipulation. Others include IP address decoys, randomizing host order, and using slow timing.

20. How does packet fragmentation help evade an IDS during scanning?

    Splitting probe packets into tiny fragments forces the IDS to reassemble them; if it cannot reassemble or inspect fragments properly, the malicious probe slips through undetected.

21. What is a decoy scan and which Nmap flag performs it?

    A decoy scan makes scans appear to come from multiple spoofed source IPs alongside the real one so the target cannot identify the true attacker. Nmap flag: -D (e.g., -D RND:10 or -D decoy1,decoy2,ME).

22. How can source port manipulation bypass poorly configured firewalls?

    Setting the scan's source port to a commonly trusted port (e.g., 53 DNS, 80, or 20 FTP-data) using Nmap -g/--source-port can slip past firewalls that whitelist traffic from those ports.

See more Scanning, Enumeration, and Vulnerability Analysis flashcards →

Planning Scanning, Enumeration, and Vulnerability Analysis for Certified Ethical Hacker (CEH)

Scanning, Enumeration, and Vulnerability Analysis (Certified Ethical Hacker (CEH)) FAQ