Exam 312-50v12 topic 1 question 147 discussion

D, IDLE SCAN is Correct because of spoofing

IDLE/IPID header scan - The attacker performs this scan by impersonating another computer via spoofing.

D. Use the IDLE/IPID header scan technique with the command "-sI"

D. • Allows for blind port scanning (without sending any packet with own IP) • Utilizes IP address of a zombie machine through spoofed packets

D. IDLE/IPID scan spoof its ip while perform scanning

IDLE/IPID header scan - The attacker performs this scan by impersonating another computer via spoofing. The attacker does not send a packet from their IP address; instead, they use another host, often called a “zombie,” to scan the remote host and identify open ports. In this attack, the attacker expects the sequence numbers of the zombie host, and if the remote host checks the IP of the scanning party, the IP of the zombie machine is displayed - Module 03 Page 315

D. Use the IDLE/IPID header scan technique with the command "-sI"