Certified Ethical Hacker (CEH) Scanning, Enumeration, and Vulnerability Analysis Syllabus

What is a decoy scan and which Nmap flag performs it?

A decoy scan makes scans appear to come from multiple spoofed source IPs alongside the real one so the target cannot identify the true attacker. Nmap flag: -D (e.g., -D RND:10 or -D decoy1,decoy2,ME).

How can source port manipulation bypass poorly configured firewalls?

Setting the scan's source port to a commonly trusted port (e.g., 53 DNS, 80, or 20 FTP-data) using Nmap -g/--source-port can slip past firewalls that whitelist traffic from those ports.

What does Nmap's --mtu option do for evasion?

It specifies a custom Maximum Transmission Unit (a multiple of 8) so Nmap fragments packets to that size, helping evade fragment-reassembly-weak IDS/firewalls.

Besides Nmap, name three other tools used for scanning or host discovery.

Hping3, Masscan, Netcat (banner grabbing), Angry IP Scanner, Unicornscan, and NetScanTools Pro are common alternatives.

What is Hping3 commonly used for in scanning?

Hping3 is a command-line packet crafter used to send custom TCP/UDP/ICMP packets for firewall testing, advanced port scanning, OS fingerprinting, and traceroute-style path discovery.

Define enumeration in the context of ethical hacking.

Enumeration is the active process of extracting detailed information — usernames, machine names, network shares, services, and resources — by making direct connections to a target system after host/port discovery.

List four categories of information typically gathered during enumeration.

Network resources/shares, usernames and group names, machine/host names, applications and banners, SNMP and DNS details, and routing tables.

What ports are associated with NetBIOS, and what does NetBIOS enumeration reveal?

NetBIOS uses UDP 137 (Name Service), UDP 138 (Datagram), and TCP 139 (Session Service). Enumeration reveals computer names, domain/workgroup, shares, logged-on users, and the NetBIOS name table.

What Windows command-line tool lists NetBIOS name table information of a remote machine?

nbtstat — e.g., 'nbtstat -A <IP>' returns the remote machine's NetBIOS name table; 'nbtstat -c' shows the local NetBIOS name cache.

On which port does SMB operate directly over TCP/IP (without NetBIOS)?

TCP port 445. SMB can run over NetBIOS (TCP 139) or directly over TCP 445.

What is a null session and why is it a security concern in SMB/NetBIOS enumeration?

A null session is an unauthenticated connection to the IPC$ share using a blank username and password. It can let attackers enumerate users, groups, shares, and policies without credentials.

What does SNMP enumeration extract, and what default community strings are exploited?

SNMP enumeration extracts device info, running processes, user accounts, routing tables, and ARP tables from the MIB. Default community strings 'public' (read-only) and 'private' (read-write) are commonly exploited.

What is the MIB in the context of SNMP?

The Management Information Base is a hierarchical, tree-structured database of object identifiers (OIDs) describing the managed device's data that SNMP can query.

Which UDP ports does SNMP use?

SNMP uses UDP port 161 for agent queries/responses and UDP port 162 for SNMP traps (notifications).

What port does LDAP use, and what does LDAP enumeration reveal?

LDAP uses TCP/UDP 389 (and 636 for LDAPS/SSL). Enumeration reveals valid usernames, departments, addresses, and the Active Directory/directory structure.

What port does NTP use, and what can NTP enumeration disclose?

NTP uses UDP port 123. Enumeration (via commands like ntpdc, ntptrace, ntpq) can disclose connected hosts, client IP addresses, internal host names, and OS information.

What port does NFS use, and what is the risk enumerated via showmount?

NFS commonly uses TCP/UDP 2049 (with portmapper on 111). 'showmount -e <host>' enumerates exported shares; misconfigured exports can expose sensitive directories to unauthorized mounting.

Which DNS feature does DNS enumeration abuse to dump all records, and via which port?

DNS zone transfer (AXFR) over TCP port 53. If a misconfigured DNS server allows it, an attacker can retrieve the entire zone file with all hostnames and IPs.

Which SMTP commands are used to enumerate valid email users on a mail server?

VRFY (verify a user), EXPN (expand a mailing list), and RCPT TO (recipient). Server responses reveal whether usernames/mailboxes exist. SMTP uses TCP port 25.

List three effective enumeration countermeasures.

Disable null sessions / restrict anonymous access (RestrictAnonymous), change or disable default SNMP community strings, disable unnecessary services and DNS zone transfers, and filter ports 139/445/161/389 at the firewall.

Define vulnerability assessment.

A vulnerability assessment is the systematic process of identifying, quantifying, classifying, and prioritizing security weaknesses (vulnerabilities) in systems, networks, and applications — without necessarily exploiting them.

How does a vulnerability assessment differ from a penetration test?

A vulnerability assessment identifies and reports weaknesses (broad, often automated, non-exploitative). A penetration test goes further by actively exploiting vulnerabilities to demonstrate real impact and is typically deeper but narrower.

Compare active vs passive vulnerability assessment.

Active assessment directly probes/interacts with hosts and network devices (sending packets) to find vulnerabilities. Passive assessment sniffs network traffic to infer vulnerabilities without directly touching targets.

What does CVSS stand for, and what is its numeric score range and severity bands?

Common Vulnerability Scoring System. Scores range 0.0–10.0: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), Critical (9.0–10.0).

What are the three metric groups in CVSS?

Base (intrinsic, constant characteristics), Temporal (change over time, e.g., exploit maturity/patch availability), and Environmental (specific to a user's environment/impact).

What is the CVE and who maintains it?

Common Vulnerabilities and Exposures — a dictionary of publicly known security flaws, each given a unique CVE ID (e.g., CVE-2021-44228). It is maintained by MITRE (sponsored by US-CERT/DHS).

What is the NVD and how does it relate to CVE?

The National Vulnerability Database (NVD), run by NIST, is the US government repository that enriches CVE entries with CVSS scores, severity ratings, CWE mappings, and references.

What is CWE and how does it differ from CVE?

CWE (Common Weakness Enumeration) is a categorized list of software/hardware weakness types (e.g., CWE-79 XSS). CVE identifies specific instances of vulnerabilities in particular products, whereas CWE classifies the underlying weakness category.

Name three popular vulnerability scanning tools.

Nessus (Tenable), Qualys, OpenVAS, Nexpose/InsightVM (Rapid7), GFI LanGuard, and Nikto (web). These automate detection and CVSS-based prioritization of vulnerabilities.

What key elements should a vulnerability assessment report contain?

Executive summary, scan scope/methodology, list of findings with severity (CVSS) and CVE references, affected assets, risk ratings, and prioritized remediation recommendations.

What are the four common remediation strategies for handling identified vulnerabilities?

Mitigate/remediate (patch or reconfigure to fix), Transfer (e.g., insurance/third party), Accept (acknowledge low risk), and Avoid (eliminate the asset/feature). Remediation is prioritized by risk/CVSS severity.