312-50 Question 76
Single answer▪ Scanning Beyond IDS and FirewallDuring an authorized external penetration test, you are asked to identify live hosts and exposed services in a client network without triggering the perimeter IDS or stateful firewall rate limits. A standard Nmap SYN scan (-sS) from your assessment VM quickly generates IDS alerts and the firewall begins dropping packets after a burst of probes. You know the client allows ICMP error messages back to the Internet and that outbound traffic is tightly filtered. Which Nmap technique would be the most appropriate next step to map live hosts while minimizing the chance of detection by the IDS and firewall?
- A
Use an ACK scan (-sA) with a high packet rate to enumerate open ports quickly
- B
Use an idle scan (-sI) through a suitable zombie host to infer port states indirectly
- C
Use a UDP scan (-sU) against all ports because UDP traffic is typically ignored by IDS devices
- D
Use a full TCP connect scan (-sT) with version detection (-sV) to blend in with normal traffic
Show answer and explanation
Correct answer: B
Explanation
For scanning beyond IDS and firewall controls, the key objective is to reduce direct, easily correlated probe traffic from the tester's host. In this scenario, an Nmap idle scan (-sI) is the most appropriate technique because it can infer target port states indirectly through a zombie system, helping the tester avoid direct exposure to perimeter monitoring tied to the scanner's IP address. By contrast, ACK scans are mainly for determining firewall filtering behavior, not for accurately enumerating open services; TCP connect scans are more detectable than SYN scans because they complete the handshake; and UDP scans are neither inherently stealthy nor commonly ignored by IDS. Nmap's reference guide documents idle scanning as a stealthy advanced scan technique, while ACK, SYN, TCP connect, and UDP scans each have distinct purposes and detection profiles. In practice, an ethical hacker should also tune timing, packet rates, and probe selection carefully, and only use such techniques within the scope of explicit authorization.
- A. Incorrect.
Incorrect. An ACK scan (-sA) is primarily used to map firewall rules and determine whether ports are filtered or unfiltered; it does not reliably identify open ports in the same way as a SYN or connect scan. Increasing the packet rate would also make IDS detection and rate limiting more likely, not less. This option reflects the common misconception that ACK scans are stealthy host/service discovery methods when they are mainly useful for firewall analysis.
- B. Correct.
Correct. An idle scan (-sI) uses a third-party 'zombie' host with predictable IP ID behavior so the tester can infer the target's response without sending packets that appear to originate directly from the scanning system. This can help bypass some IDS and firewall monitoring focused on the tester's source IP and is a classic CEH-relevant technique for scanning beyond IDS/firewall controls. It is not universally possible because it depends on finding a suitable zombie, but given the scenario, it is the best next step for stealthier reconnaissance.
- C. Incorrect.
Incorrect. UDP scans (-sU) are not generally ignored by IDS devices, and broad UDP probing can be noisy and slow. Many UDP services do not respond unless probed correctly, and firewalls often filter or rate-limit UDP as well. While UDP scanning can be useful in some assessments, it is not the best choice here for minimizing detection after a SYN scan has already triggered alerts.
- D. Incorrect.
Incorrect. A full TCP connect scan (-sT) completes the three-way handshake and is typically more visible than a half-open SYN scan. Adding version detection (-sV) increases the number and variety of probes, making the activity even easier to detect. This option is plausible because it uses legitimate TCP connections, but in practice it is usually less stealthy, not more.