Exam 312-50v12 topic 1 question 70 discussion

D. Idle scanning Like 312-50v11 Q228

D. Idle scanning

The attacker performs this scan by impersonating another computer via spoofing. The attacker does not send a packet from their IP address; instead, they use another host, often called a “zombie,” to scan the remote host and identify open ports. In this attack, the attacker expects the sequence numbers of the zombie host, and if the remote host checks the IP of the scanning party, the IP of the zombie machine is displayed. CEH V12 pg 315-316

D. Idle scanning

D. Idle scanning https://en.wikipedia.org/wiki/Idle_scan#Finding_a_zombie_host The first step in executing an idle scan is to find an appropriate zombie. It needs to assign IP ID packets incrementally...

The correct option is D. Idle scanning (also known as zombie scanning) is a firewall evasion technique that uses a zombie system with low network activity to scan a target system

The correct answer is A. Packet fragmentation scanning is a technique used to evade firewalls by fragmenting packets to bypass firewall rules. In this technique, the attacker sends a large packet that is broken down into smaller fragments. The fragments are sent to the target system and are reassembled by the system's TCP/IP stack. The firewall may only inspect the first fragment, allowing the subsequent fragments to bypass the firewall rules. The attacker may use a zombie system with low network activity to generate fragmented packets with random fragment identification numbers to evade detection. In contrast, the technique mentioned in the question uses the fragmentation identification numbers of a zombie system to evade firewall scanning. Therefore, the correct answer is A, packet fragmentation scanning.

D. Idle scanning

A. Packet fragmentation scanning Packet fragmentation scanning involves breaking up packets into smaller fragments to evade firewall or intrusion detection system (IDS) rules that are configured to block or detect packets of a certain size or pattern. By using a zombie system with low network activity, the attacker can minimize the chances of detection and increase the chances of successful evasion. The attacker can also manipulate the fragment identification numbers to avoid detection.