Exam 312-50v13 topic 1 question 147 discussion

IDLE Scan (-sI) is a stealthy scanning technique that allows an attacker to scan a target network without revealing their own IP address. It uses a "zombie" host (an idle system) to relay the scan, making it appear as if the scan is originating from the zombie rather than the attacker. It does not send packets directly from the attacker's machine, thus providing complete anonymity. It can detect open ports and services without being easily detected by intrusion detection systems (IDS).

The IDLE/IPID header scan technique (-sI) is the best option for performing a network scan while keeping the attacker's IP address hidden. It is specifically designed for stealth and is the most appropriate choice for this red team task.

D. Use the IDLE/IPID header scan technique with the command "-sI" Explanation: The IDLE scan (-sI) is a stealthy scanning technique that allows a hacker to scan a target without revealing their own IP address. Instead, it leverages a "zombie" (an idle host with predictable IPID sequence numbers) to send packets on behalf of the attacker. Why is this the best choice? The attacker's IP address remains hidden because the "zombie" host is the one interacting with the target. It provides open port detection while avoiding direct interaction with the target. It is difficult to trace back to the attacker, making it useful for stealthy reconnaissance in a red team assessment.