Question

There is strong evidence that a machine is compromised on your company network, but you have not determined which computer.

You are going to try to pinpoint the host by scanning for any network devices that are in promiscuous mode.

Which of the following Nmap scripts would you use?]

finger


vulners


icap-info


sniffer-detect

Answer 1

sniffer-detect

The NSE script "sniffer-detect" is designed to find hosts in promiscuous (sniffer) mode. Run it as root (it sends raw probes), e.g.:
nmap -sn --script sniffer-detect 192.168.1.0/24

Note: results can have false positives/negatives; confirm with additional investigation.