CompTIA PenTest+ (PT0-003)Reconnaissance and EnumerationMedium
A penetration tester has gained internal access to a Linux server within a client's network. They need to quickly identify all currently listening network services and the associated processes, including their PIDs and the user running them, to understand the server's attack surface. Which command would provide the MOST comprehensive output for this task?
- Ass -tulpn
- Bps aux | grep LISTEN
- Clsof -i
- Dnetstat -tulnp
Show answer & explanationAnswer & explanation
Correct answer: D. netstat -tulnp
The 'netstat -tulnp' command on Linux is highly effective. '-t' shows TCP, '-u' shows UDP, '-l' shows listening sockets, '-n' shows numerical addresses, and '-p' shows the PID and program name. This combination provides a comprehensive list of listening services and their associated process information.
Why the other options are wrong
- A. The 'ss' command is a newer replacement for netstat, but the option combination here (tulpn) is effectively the same as netstat's and less universally known than netstat for this specific enumeration.
- B. This command attempts to filter process lists for 'LISTEN', which is imprecise and won't directly show port numbers or the full network socket information provided by netstat.
- C. The 'lsof -i' command lists open files related to network connections, which can be useful, but 'netstat -tulnp' is generally more direct and comprehensive for *listening* services and their PIDs.
netstat -tulnp
The 'netstat -tulnp' command on Linux lists all TCP and UDP listening sockets, displaying numerical addresses, and crucially, the Process ID (PID) and program name associated with each listening service. It's a key command for service enumeration.
- '-t': TCP connections.
- '-u': UDP connections.
- '-l': Listening sockets.
- '-n': Numerical addresses (prevents DNS lookups).
- '-p': Shows PID and program name.
Memory trick: Netstat with TULNP reveals all listening processes.