312-50 Question 70
Single answer▪ OS Discovery (Banner Grabbing/OSDuring an authorized internal assessment, you need to identify the operating system of a server at 10.10.20.15 while minimizing network noise to avoid triggering the client's IDS. A TCP scan shows only ports 22 and 80 open. The web page uses a generic reverse-proxy error page and does not reveal platform details. Which action is the MOST appropriate next step to gather OS information with the least additional footprint?
- A
Connect to TCP/22 and review the SSH banner for product and platform clues
- B
Run Nmap with aggressive OS detection and version detection: nmap -A 10.10.20.15
- C
Send a large ICMP echo sweep with varied packet sizes to fingerprint the TCP/IP stack
- D
Launch an SMB null session against the host to enumerate native OS details
Show answer and explanation
Correct answer: A
Explanation
The best answer is to perform banner grabbing against an already open service, specifically SSH on port 22, because it satisfies the scenario's goal of obtaining OS clues while keeping traffic minimal. In real assessments, passive or minimally invasive service interrogation is preferred before active fingerprinting. SSH banners commonly expose software names and versions in the initial handshake, and HTTP headers can also help when available; however, the scenario states the web service is behind a generic reverse proxy and provides little value. By contrast, Nmap aggressive scanning (-A) is powerful but noisier because it combines multiple techniques including service/version detection, NSE scripts, OS detection, and traceroute. CEH candidates should recognize that banner grabbing is often the first practical step for OS discovery when stealth matters. This aligns with common security testing practice and Nmap documentation, which distinguishes light-touch service interrogation from broader active fingerprinting methods.
- A. Correct.
Correct. Banner grabbing from an already identified open service is a low-noise, practical next step. SSH commonly returns a protocol and software banner such as OpenSSH version information, and that can provide useful OS clues because distributions often ship characteristic package versions or comments. Even when the banner does not explicitly name the OS, it can still narrow possibilities significantly with minimal extra traffic.
- B. Incorrect.
Incorrect. Nmap -A enables OS detection, version detection, script scanning, and traceroute. While effective, it is not the least noisy option and generates substantially more traffic than simply connecting to an already open service and reading its banner. In this scenario, the requirement is to minimize additional footprint.
- C. Incorrect.
Incorrect. ICMP echo sweeps are used primarily for host discovery, not reliable OS identification. Varying packet sizes alone is not a standard low-noise method for OS discovery, and many hosts or firewalls filter or normalize ICMP behavior. This choice reflects a misconception that ICMP probing is the preferred first step for OS fingerprinting.
- D. Incorrect.
Incorrect. SMB null sessions can reveal rich OS details on Windows systems, but this host only showed ports 22 and 80 open. SMB enumeration requires SMB-related ports such as 139 or 445 to be accessible. Attempting this here is unlikely to work and does not align with the evidence already gathered.