Which of the following Nmap commands will return vulnerable ports that might be interesting to a potential attacker?

A penetration tester is scanning a corporate lab network for potentially vulnerable services.

Which of the following Nmap commands will return vulnerable ports that might be interesting to a potential attacker?
A . nmap192.168.1.1-5CPU22-25,80
B. nmap192.168.1.1-5CPA22-25,80
C. nmap192.168.1.1-5CPS22-25,80
D. nmap192.168.1.1-5CSs22-25,80

View Answer

Answer: C

Explanation:

PS/PA/PU/PY are host discovery flags which use TCP SYN/ACK, UDP or SCTP discovery respectively. And since the ports in the options are mostly used by TCP protocols, then it’s either the PS or PA flag. But since we need to know if the ports are live, sending SYN packet is a better alternative. Hence, I choose PS in this case.