Ethical Hacking Scanning Networks Syllabus

Scanning Networks syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Scanning Networks in Ethical Hacking, not a summary of it.

1. 1

   Network Scanning Concepts

   3 topics

   • Types of Scans
   • Scanning Techniques
   • Interpreting Scan Results
2. 2

   Scanning Tools

   3 topics

   • Nmap
   • Angry IP Scanner
   • Advanced IP Scanner
3. 3

   Vulnerability Scanning

   3 topics

   • Types of Vulnerabilities
   • Common Vulnerability Scanners
   • Interpreting Vulnerability Reports

Scanning Networks flashcards for Ethical Hacking

20 of 50 cards from the Scanning Networks deck — real questions with worked answers.

1. What is network scanning in ethical hacking?

   An active reconnaissance phase where an attacker sends packets to hosts to discover live systems, open ports, running services, operating systems, and vulnerabilities on a target network.

2. What are the three main objectives (types) of scanning?

   Port scanning (discovering open ports/services), network scanning (identifying live hosts/IP addresses), and vulnerability scanning (finding known weaknesses on hosts).

3. What does a TCP three-way handshake consist of, and why does it matter for scanning?

   SYN -> SYN/ACK -> ACK. Scanners exploit this sequence: a returned SYN/ACK indicates an open port, while a RST indicates a closed port.

4. What is a TCP Connect scan (full-open scan)?

   A scan that completes the full three-way handshake (SYN, SYN/ACK, ACK) with each port. It is reliable and needs no special privileges but is easily logged and detected.

5. What is a SYN scan (half-open / stealth scan)?

   A scan that sends a SYN, receives SYN/ACK for open ports, then sends RST to tear down before completing the handshake. It is fast, stealthier, and requires raw-packet (root) privileges.

6. In a SYN scan, how are open, closed, and filtered ports distinguished?

   Open = SYN/ACK received; Closed = RST received; Filtered = no response or ICMP unreachable (packet dropped by a firewall).

7. How do FIN, NULL, and Xmas scans work and what is their advantage?

   They send TCP packets with unusual flag combinations (FIN only; no flags; FIN+PSH+URG). A closed port replies RST; an open port sends nothing. They can bypass some stateless firewalls but fail against Windows hosts.

8. Which TCP flags are set in an Xmas scan?

   FIN, PSH, and URG (the packet is 'lit up like a Christmas tree').

9. What is an ACK scan primarily used to determine?

   Firewall rule sets and whether ports are filtered vs unfiltered. It cannot determine open/closed; an unfiltered port returns RST while a filtered one returns no reply or ICMP unreachable.

10. What is an idle (zombie) scan and its key benefit?

    A blind scan that uses a third-party 'zombie' host's predictable IP ID sequence to probe a target, so the target never sees the attacker's real IP address, providing full anonymity.

11. How does a UDP scan detect a closed port versus an open port?

    A closed UDP port returns an ICMP Port Unreachable (type 3, code 3) message; an open or filtered port typically returns no response, making UDP scanning slower and less reliable.

12. What is a ping sweep (ICMP sweep) used for?

    Sending ICMP Echo Requests to a range of IP addresses to identify which hosts are live and reachable on the network.

13. Which ICMP message types correspond to Echo Request and Echo Reply?

    Echo Request is ICMP type $8$; Echo Reply is ICMP type $0$.

14. What is banner grabbing?

    A technique that connects to open ports/services to read the returned banner, revealing the service name, software version, and OS to help identify vulnerabilities (fingerprinting).

15. What is the difference between active and passive OS fingerprinting?

    Active fingerprinting sends crafted packets and analyzes responses (e.g., Nmap's -O). Passive fingerprinting sniffs existing traffic without sending packets, making it stealthier but less precise.

16. What does IP fragmentation achieve as a scan-evasion technique?

    Splitting probe packets into small fragments so packet filters and IDS that do not reassemble fragments fail to detect the scan signature.

17. What is decoy scanning?

    An evasion technique that spoofs multiple decoy source IP addresses alongside the real one, so the target's logs cannot easily identify which host is the true scanner.

18. What is Nmap and who created it?

    Nmap (Network Mapper) is a free, open-source utility for network discovery and security auditing, created by Gordon Lyon (Fyodor).

19. What are the three port states most commonly reported by Nmap?

    Open (an application is accepting connections), Closed (reachable but no application listening), and Filtered (a firewall/filter blocks the probe so state cannot be determined).

20. What Nmap flag performs a SYN (stealth) scan, and why does it need privileges?

    The -sS flag. It crafts raw TCP packets, which requires root/administrator privileges.

See more Scanning Networks flashcards →

Planning Scanning Networks for Ethical Hacking

Scanning Networks (Ethical Hacking) FAQ