Hit-List Scanning Technique in Botnet Creation
To create a botnet, the attacker can use several techniques to scan vulnerable machines. The attacker first collects information about a large number of vulnerable machines to create a list. Subsequently, they infect the machines. The list is divided by assigning half of the list to the newly compromised machines. The scanning process runs simultaneously. This technique ensures the spreading and installation of malicious code in little time. Which technique is discussed here?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The core concept tested is how attackers optimize scan speed and stealth by using a pre-defined list rather than random or topological methods.
This question identifies the hit-list scanning technique, where attackers pre-collect a list of vulnerable targets to efficiently spread botnets by dividing the workload among compromised hosts.
Candidates often confuse this with topological or permutation scanning, failing to recognize that the 'pre-collected list' is the defining characteristic of hit-list scanning.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is C — Hit-list scanning. This technique involves the attacker first gathering a large list of potentially vulnerable machines (the "hit list") and then targeting them specifically. As noted in community discussions, "Through scanning, an attacker first collects a list of potentially vulnerable machines and then creates a zombie army," which matches the scenario described. The key differentiator is the use of a pre-existing list rather than scanning subnets or topology.Why the Other Options Are Wrong
Subnet scanning (A) typically involves iterating through IP ranges within a subnet, which is slower and less targeted than using a specific list. Permutation scanning (B) uses algorithms to determine the next target based on previous results to evade IDS, not a static pre-collected list. Topological scanning (D) maps network connections and dependencies, focusing on structure rather than a pre-determined list of vulnerable hosts for infection.Community Comment Notes
Community consensus strongly supports option C. One commenter explained that the attacker "collects a list... and then creates a zombie army," highlighting the initial reconnaissance phase. Another user simply confirmed "HIT LIST SCANNING" as the direct answer, reflecting the straightforward nature of the definition provided in study materials.Exam Strategy
Focus on the keywords 'list', 'collected information', and 'divided'. When you see a pre-defined list of targets being used to coordinate attacks or infections, think 'Hit-List'. Avoid options like 'Topological' which imply mapping relationships, or 'Permutation' which implies algorithmic generation.
Frequently Asked Questions
Why is hit-list scanning faster than subnet scanning?
Hit-list scanning skips non-vulnerable IPs entirely, focusing only on known targets, whereas subnet scanning must check every address in a range.
How does hit-list scanning help evade detection?
By targeting specific machines from a list rather than broadcasting scans across a subnet, it reduces noise and avoids triggering threshold-based IDS alerts.