Ethical Hacking Scanning Networks Syllabus

What do the Nmap flags -sT, -sU, and -sA do?

-sT = TCP Connect scan; -sU = UDP scan; -sA = ACK scan (firewall rule mapping).

What does the Nmap -O flag do?

Enables OS detection by analyzing TCP/IP stack fingerprints to guess the target operating system.

What does the Nmap -sV flag do?

Performs service/version detection, probing open ports to determine the application name and version number running.

What is the purpose of the Nmap -p flag, and how do you scan all ports?

-p specifies which ports to scan (e.g., -p 80,443 or -p 1-1000). Use -p- to scan all $65535$ ports.

What Nmap timing templates exist and what does -T4 mean?

Timing templates range -T0 (paranoid) to -T5 (insane). -T4 (aggressive) speeds up scans on fast, reliable networks while remaining reasonably reliable.

What is the Nmap Scripting Engine (NSE)?

A framework using Lua scripts (invoked with -sC or --script) to automate advanced tasks such as vulnerability detection, brute forcing, and service enumeration.

What does the Nmap -A flag enable?

Aggressive scan mode: OS detection (-O), version detection (-sV), default script scanning (-sC), and traceroute all at once.

What Nmap option performs host discovery only (no port scan)?

-sn (formerly -sP), a 'ping scan' that lists which hosts are up without scanning their ports.

What is Angry IP Scanner and a key characteristic of it?

A lightweight, open-source, cross-platform (Java-based) IP address and port scanner. It uses multithreaded pinging for speed and requires no installation.

By default, how does Angry IP Scanner determine if a host is alive, and what data can it gather?

It pings each IP; hosts are marked alive/dead by ping response. It can also resolve hostnames, MAC addresses, NetBIOS info, and scan open ports via plugins.

What is Advanced IP Scanner and which OS does it target?

A free, fast network scanner for Windows that discovers devices on a LAN, showing IP/MAC addresses, hostnames, and shared folders, with remote control via RDP and Radmin.

Compare Nmap, Angry IP Scanner, and Advanced IP Scanner in one line each.

Nmap: powerful, deep, cross-platform, scriptable (CLI/GUI). Angry IP Scanner: lightweight, fast, cross-platform host/port scanner. Advanced IP Scanner: Windows-only LAN discovery with remote access features.

What is a vulnerability in security terms?

A weakness or flaw in a system's design, implementation, configuration, or operation that can be exploited by a threat to compromise confidentiality, integrity, or availability.

Distinguish a vulnerability, a threat, and an exploit.

A vulnerability is a weakness; a threat is a potential danger that could exploit it; an exploit is the actual code or method that leverages the vulnerability to cause harm.

What is a zero-day vulnerability?

A previously unknown flaw for which no patch exists, giving defenders 'zero days' to fix it before it can be exploited in the wild.

What is a misconfiguration vulnerability? Give an example.

A security weakness caused by improper setup rather than a code flaw, e.g., default credentials, unnecessary open ports/services, or overly permissive file permissions.

What is the difference between an unpatched-software vulnerability and a design vulnerability?

An unpatched-software vulnerability exists in code that has an available fix not yet applied; a design vulnerability is a flaw inherent in the architecture itself, often requiring redesign rather than a patch.

Name three common software vulnerability classes attackers target.

Buffer overflows, SQL injection, and cross-site scripting (XSS). (Others: broken authentication, insecure deserialization, misconfiguration.)

What is a buffer overflow vulnerability?

A flaw where a program writes more data to a buffer than it can hold, overwriting adjacent memory, which can crash the program or let an attacker execute arbitrary code.

What are the three phases of the vulnerability management lifecycle most relevant to scanning?

Discovery/scanning (identify assets and weaknesses), assessment/prioritization (rank by risk), and remediation/verification (patch and rescan to confirm).

What is a credentialed (authenticated) vulnerability scan versus a non-credentialed scan?

A credentialed scan logs in with valid credentials to inspect the system from the inside (more accurate, fewer false positives); a non-credentialed scan probes externally as an unauthenticated attacker would.

Name four widely used vulnerability scanners.

Nessus (Tenable), OpenVAS/Greenbone, Qualys, and Rapid7 Nexpose/InsightVM. (Nikto is common for web servers.)

What is Nessus and what is its output based on?

A popular commercial vulnerability scanner by Tenable that uses regularly updated plugins to detect known vulnerabilities, misconfigurations, and missing patches, then reports findings with severity ratings.

What is OpenVAS?

Open Vulnerability Assessment Scanner (part of Greenbone), a free/open-source full-featured vulnerability scanner using a continuously updated feed of network vulnerability tests (NVTs).

What is Nikto used for?

An open-source web server scanner that tests for dangerous files, outdated server software, and thousands of known web vulnerabilities and misconfigurations.

What is CVE and what does it provide?

Common Vulnerabilities and Exposures: a standardized dictionary that assigns each publicly known vulnerability a unique identifier (e.g., CVE-2021-44228) for consistent reference across tools.

What is CVSS and what range are its scores?

The Common Vulnerability Scoring System, which rates vulnerability severity on a scale from $0.0$ to $10.0$ based on exploitability and impact metrics.

What are the standard CVSS v3 severity rating bands?

None $= 0.0$; Low $= 0.1\text{--}3.9$; Medium $= 4.0\text{--}6.9$; High $= 7.0\text{--}8.9$; Critical $= 9.0\text{--}10.0$.

What is a false positive versus a false negative in a vulnerability report?

A false positive is a reported vulnerability that does not actually exist; a false negative is a real vulnerability the scanner failed to detect. False negatives are more dangerous because they leave real risk unseen.

When interpreting and prioritizing a vulnerability report, what key factors determine remediation order?

CVSS severity score, whether a public exploit exists (exploitability), asset criticality/exposure (internet-facing vs internal), and business impact — highest-risk, actively exploited findings on critical assets are fixed first.