Enumeration Techniques PT0-003 Practice Questions (Page 7)

Questions 31–32

1. 31expert · hard

   During a penetration test, you have identified a web server on port 443. You want to determine the exact version of the web server software and the underlying operating system. You have tried banner grabbing with netcat, but the server does not return a banner. Which of the following is the MOST effective alternative technique?

   • APerform a DNS reverse lookup on the server IP
   • BSend a malformed HTTP request to trigger an error page
   • CUse the 'whatweb' tool to identify the web server
   • DUse Nmap with the '-sV' and '-O' flags
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A penetration tester has been given permission to assess a web application hosted on a single server. The tester wants to identify which services are running on non-standard ports to find potential attack vectors. The tester has already performed a SYN scan and found several open ports. What is the NEXT logical step to determine the specific service versions running on those ports?

   • AUse 'nc -vz' to check if the ports are open
   • BRun 'nmap -sV' against the identified open ports
   • CRun 'nmap -O' to detect the operating system
   • DPerform a UDP scan on all ports
   Reveal Solution Discussion Select an answer first