MENU
You work as a Penetration Tester for the Infosec Inc. Your company takes the projects of security auditing. Recently, your company has assigned you a project to test the security of the we-aresecure. com Web site. For this, you want to perform the idle scan so that you can get the ports open in the we-are-secure.com server. You are using Hping tool to perform the idle scan by using a zombie computer. While scanning, you notice that every IPID is being incremented on every query, regardless whether the ports are open or close. Sometimes, IPID is being incremented by more than one value. What may be the reason?
Suggested Answer: C
Get Premium GPEN Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
36 comments · newest first
JA
Jacquline
9 months ago
Not sure about that, could be a misconfiguration too.
LO
Lorrie
10 months ago
Wait, Hping can't do idle scans? That's surprising!
TO
Tony
10 months ago
I think it's definitely the firewall messing things up.
TA
Tandra
10 months ago
Sounds like the zombie's busy with other traffic.
AD
Adelaide
10 months ago
I agree, the zombie must be interacting with something else.
MY
My
11 months ago
I thought Hping was capable of idle scanning, so I doubt option D is correct. But I could be mistaken about its capabilities.
EL
Ellsworth
11 months ago
I practiced idle scans before, and I recall that the zombie needs to be connected to the target for it to work properly. So, option C could make sense too.
GR
Gregoria
11 months ago
I'm not entirely sure, but I think firewalls can sometimes interfere with scans. Maybe option B is a possibility?
LA
Lacresha
11 months ago
I remember reading that if the zombie is interacting with other systems, it could cause the IPID to increment unexpectedly. So, option A might be the right choice.
LO
Lorrie
11 months ago
Hmm, I'm not sure about that last option. Hping is a pretty powerful tool, so I doubt it wouldn't be able to perform an idle scan. I'll have to double-check that.
CA
Cassie
12 months ago
Ah, I see. If the zombie computer isn't properly connected to the target server, that could definitely lead to the IPID issue. Good point to consider.
CO
Cora
12 months ago
Wait, I'm a bit confused. Is the firewall really a possible reason here? I thought the idle scan was designed to bypass firewalls.
YO
Yong
12 months ago
Okay, let's see. The zombie computer interacting with another system could definitely cause the IPID to increment in unexpected ways. I'll keep that in mind.
RE
Rebecka
1 year ago
Hmm, this seems like a tricky one. I'll need to think carefully about the possible reasons for the IPID behavior.
LY
Lynelle
1 year ago
Zombie computer, huh? Sounds like this penetration test is more like a haunted house than an audit.
YU
Yuette
1 year ago
Hping not doing idle scanning? That's like saying a screwdriver can't screw in screws. I'm pretty sure that's not the issue here.
AM
Amira
1 year ago
B) The firewall is blocking the scanning process.
TA
Tammara
1 year ago
A) The zombie computer is the system interacting with some other system besides your computer.
TH
Theresia
1 year ago
B) The firewall is blocking the scanning process.
DI
Diane
1 year ago
A) The zombie computer is the system interacting with some other system besides your computer.
MA
Maryann
1 year ago
Wait, so the zombie computer isn't even connected to the target server? That's a pretty big problem for the idle scan to work. Gotta be option C.
DO
Douglass
1 year ago
Looks like we need to make sure the zombie computer is properly connected to the we-are-secure.com server for the idle scan to be effective.
RO
Rosalia
1 year ago
That's true, option C seems to be the most likely reason for the IPID incrementing regardless of open ports.
RH
Rhea
1 year ago
Yeah, if the zombie computer isn't connected to the target server, then the idle scan won't work.
IZ
Izetta
1 year ago
Nah, the firewall blocking the scan wouldn't cause the IPID to increment in that way. I think you're on the right track with the zombie computer being the issue.
WE
Wenona
1 year ago
A) The zombie computer is the system interacting with some other system besides your computer.
BE
Bette
1 year ago
B) The firewall is blocking the scanning process.
LE
Lettie
1 year ago
A) The zombie computer is the system interacting with some other system besides your computer.
FE
Felix
2 years ago
But what if the firewall is blocking the scanning process? Could that also be a reason?
CH
Charlette
2 years ago
Hmm, if the IPID is incrementing even for closed ports, it sounds like the zombie computer is interacting with something else besides the target server. I'd go with option A.
EL
Elliot
1 year ago
No, I don't think the firewall is the issue here.
LO
Lonna
1 year ago
Maybe the firewall is blocking the scanning process.
SA
Sabina
1 year ago
Yeah, that could be the reason for the IPID incrementing.
JA
Jackie
1 year ago
I think the zombie computer is interacting with another system.
YO
Yoko
2 years ago
I agree with Avery. It makes sense that the IPID is being incremented because of that.
AV
Avery
2 years ago
I think the reason could be that the zombie computer is interacting with another system.