Question

As a pentester you are testing a network and detect an NIDS that is presenting an obstacle towards carrying out additional scans. You have decided to implement evasion techniques in an nmap scan in order to avoid triggering the generation of an alert to the administrator. Which of these nmap scans should you use?

a. nmap -sS -T0
b. nmap -sS -v
c. nmap -sT -T0
d. nmap -sX -T5

Answer 1

The best option to conduct an nmap scan while avoiding detection by a NIDS is nmap -sS -T0, which combines a stealthy SYN scan with the slowest scan timing.

Step-by-step explanation:

If you are conducting a penetration test and need to implement evasion techniques to avoid triggering an alert from a Network Intrusion Detection System (NIDS), you should consider the characteristics of the NIDS and the scan types available in nmap. The answer to the question depends on the mechanics of the scan types and how they might interact with detection mechanisms.

The nmap flags in the different options represent different scanning techniques and speeds:

• -sS indicates a SYN scan, which is a stealthy type of scan because it does not complete the TCP three-way handshake.
• -T0 refers to the timing option which sets the scan speed to the slowest possible to avoid triggering alarms.
• -sT represents a full connect scan, which is less stealthy because it completes the TCP three-way handshake.
• -sX stands for Xmas scan, a technique that sends a packet with the FIN, PSH, and URG flags set, potentially disguising the scan.
• -T5 indicates the fastest scan speed, which is more likely to be detected.
• -v enables verbose mode, which has no direct impact on stealth.

Given these explanations, the option a. nmap -sS -T0 would be the best choice for avoiding detection by an NIDS while conducting scans. This command combines the stealthiness of a SYN scan with the slowest possible speed to reduce the chances of the NIDS detecting the scan.