ECSA v10: EC-Council Certified Security Analyst v10Demo

By ECCouncil · Question Mode

QuestionQ51

Open-Source Intelligence (OSINT) Methodology

As part of information gathering, you receive a website URL and are asked to identify the operating system through passive OS fingerprinting. When you start using the p0f tool and browse to the website URL, it captures and decodes header information from every sent and received packet. Which decoded request/response packet contains the operating-system information for the remote operating system?

  • A SYN
  • B SYN-ACK
  • C ACK
  • D RST
Explanation

In a TCP handshake, the SYN packet is sent by the client, while the SYN-ACK packet is returned by the remote server. Passive fingerprinting of the remote host uses TCP/IP stack characteristics in that SYN-ACK response.

Community Discussion

No comments yet. Be the first to start the discussion!