Hit-List Scanning Technique in Botnet Creation

312-50v13 By islever Editorial Last updated

Scanning Networks

Short answer

C The hit-list scanning technique uses a pre-collected list of vulnerable machines to coordinate simultaneous infections and rapid botnet growth.

Question

To create a botnet, the attacker can use several techniques to scan vulnerable machines. The attacker first collects information about a large number of vulnerable machines to create a list. Subsequently, they infect the machines. The list is divided by assigning half of the list to the newly compromised machines. The scanning process runs simultaneously. This technique ensures the spreading and installation of malicious code in little time. Which technique is discussed here?
  1. Subnet scanning technique
  2. Permutation scanning technique
  3. Hit-list scanning technique. Correct Answer
  4. Topological scanning technique

Key Takeaways

The core concept tested is how attackers optimize scan speed and stealth by using a pre-defined list rather than random or topological methods.

This question identifies the hit-list scanning technique, where attackers pre-collect a list of vulnerable targets to efficiently spread botnets by dividing the workload among compromised hosts.

Common mistake: Candidates often confuse this with topological or permutation scanning, failing to recognize that the 'pre-collected list' is the defining characteristic of hit-list scanning.

Expert Analysis

Why the Answer Is Correct

The correct answer is C — Hit-list scanning. This technique involves the attacker first gathering a large list of potentially vulnerable machines (the "hit list") and then targeting them specifically. As noted in community discussions, "Through scanning, an attacker first collects a list of potentially vulnerable machines and then creates a zombie army," which matches the scenario described. The key differentiator is the use of a pre-existing list rather than scanning subnets or topology.

Why the Other Options Are Wrong

Subnet scanning (A) typically involves iterating through IP ranges within a subnet, which is slower and less targeted than using a specific list. Permutation scanning (B) uses algorithms to determine the next target based on previous results to evade IDS, not a static pre-collected list. Topological scanning (D) maps network connections and dependencies, focusing on structure rather than a pre-determined list of vulnerable hosts for infection.

Community Comment Notes

Community consensus strongly supports option C. One commenter explained that the attacker "collects a list... and then creates a zombie army," highlighting the initial reconnaissance phase. Another user simply confirmed "HIT LIST SCANNING" as the direct answer, reflecting the straightforward nature of the definition provided in study materials.

Exam Strategy

Focus on the keywords 'list', 'collected information', and 'divided'. When you see a pre-defined list of targets being used to coordinate attacks or infections, think 'Hit-List'. Avoid options like 'Topological' which imply mapping relationships, or 'Permutation' which implies algorithmic generation.

Frequently Asked Questions

Why is hit-list scanning faster than subnet scanning?

Hit-list scanning skips non-vulnerable IPs entirely, focusing only on known targets, whereas subnet scanning must check every address in a range.

How does hit-list scanning help evade detection?

By targeting specific machines from a list rather than broadcasting scans across a subnet, it reduces noise and avoids triggering threshold-based IDS alerts.

More 312-50v13 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. SNimlaka 👍 1 Answered C
    Hit-list Scanning Through scanning, an attacker first collects a list of potentially vulnerable machines and then creates a zombie army. Subsequently, the attacker scans the list to find a vulnerable machine. On finding one, the attacker installs malicious code on it and divides the list in half. The attacker continues to scan one half, whereas the other half is scanned by the newly compromised machine. This process keeps repeating, causing the number of compromised machines to increase exponentially. This technique ensures the installation of malicious code on all the potentially vulnerable machines in the hit list within a short time.
  2. JOHNBOO 👍 1 Answered C
    The correct answer is: C. Hit-list scanning technique.
  3. shabnaluttu 👍 1 Answered C
    HIT LIST SCANNING

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Agent-Based vs Network-Based Vulnerability Scanners

S-grade

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

SQL Injection Bypass in Login Forms

S-grade

← Back to 312-50v13 Study Guide