These three types of scans exploit a vulnerability in the TCP protocol standard to distinguish open and closed ports. The standard states that "if the state of the target port is CLOSED... an incoming segment without an RST causes an RST to be sent in response".

When systems are scanned according to this rule, any packet that does not have SYN, RST, or ACK bits will result in a returned RST if the port is closed and no response if the port is open. As long as these three bits are not included, any combination of the others (FIN, PSH, and URG) is acceptable. Nmap utilizes this with three scan types:

- Null scanning (-sN) Does not set any bits (TCP flag header is 0)
- FIN scanning (-sF) Sets only the TCP FIN flag.
- Xmas scanning (-sX) sets the FIN, PSH, and URG flags, illuminating the packet like a Christmas tree.

These three types of scans work exactly the same way except for the TCP flags used in them. The responses are handled as follows.

- No response received (even after resending) -> open|filtered
- The answer is TCP RST packet -> the port is closed
- Any other answer -> filtered

The key advantage of these scanning types is that they can bypass certain firewalls and packet filters. Such firewalls attempt to block incoming TCP connections (while allowing outgoing connections) by blocking all TCP packets with the SYN bit set and the ACK bit cleared. NULL, FIN, and Xmas scans remove the SYN bit and thus pass straight through them.

@exercise f1493c420f1f


Use the NULL, FIN, and XMAS scans learned in the module and scan port 5000 of the target address with each technique. You can use the flag (-p) to specify the port. After successful scans, you will see a flag on the webpage.

Nmap NULL FIN XMAS scan

TCP FIN, NULL and Xmas scan

Nmap is one of the most well-known tools that you can use to perform versatile network scans. Every information security professional should know how to use this tool.

Nmap is one of the most well-known network scanning tools, often used by cybersecurity experts. In this course, we will learn how to use this tool and explore its capabilities. Additionally, we will examine the traffic generated by the tool and analyze the pros and cons of different scanning methods. It is beneficial to have an understanding of how networks operate in this course.

Warning! - Conducting network scans without permission may cause system malfunctions and/or crashes. Please refrain from attempting to scan any address/system without certainty that said system is in your possession or that you have permission to do so.

Computer Networks

What is Nmap?

Nmap installation on your own workstation (optional)

Intro

Defining the destination

Detection of hosts

Host discovery techniques

Finding hosts

Introduction to port scanning

Saving the output and determining the resolution of the output

Configuring ports

Choices related to timing

IPv6 scanning

Port scanning - overview

TCP SYN scan

TCP connect scan

UDP scan

TCP ACK scan

IP Protocol scan

Port scanning techniques

Identification of services (-sV)

Identification of services and operating system

An introduction to Nmap scripts

Nmap scripts

Nmap

TCP FIN, NULL and Xmas scan

Learn to hack — start here