Question
A penetration tester is performing network reconnaissance. The tester wants to gather information about the network without causing detection mechanisms to flag the reconnaissance activities. Which of the following techniques should the tester use?
- A. Sniffing Correct
- B. Banner grabbing
- C. TCP/UDP scanning
- D. Ping sweeps
Explanation
Sniffing is passive: the tester only listens to traffic already on the network and sends no packets, so intrusion detection systems have nothing to flag. Banner grabbing, TCP/UDP port scanning and ping sweeps all actively send probes to hosts, and those probes are exactly what IDS and firewall logs are designed to detect.
