Where can I use the TCP FIN scan?

Question

For a coursework i've got to run the various port scans, i'm having trouble with the FIN scan though, I can't seem to find a system where I can try it, everywhere I try it all ports either come back as Open | Filtered or all closed (which I know is not correct).

As i understand it's used to get around stateless firewalls that block SYN scans, does anyone know an operating system or setup I can use to get a few screenshots of it working in action?

The background is RFC 793 says open ports should discard out-of-state segments and closed ports should return a RST packet, but lots of operating systems don't follow the RFC to heart, i'm looking for a system that does so I can test the FIN scan out.

Answer 1

I would like to remind you that FIN scan does not work on windows operating systems. Furthermore, the existence of firewalls can prevent the scan from returning the correct result.

It will work fine on Mac and Linux. (Unless the port has been filtered by a firewall) I tested with Kali Linux-Kernel 3.14 and it works.

root@kali:~# nmap -sF 127.0.0.1 -p 80

Starting Nmap 6.46 ( http://nmap.org ) at 2014-10-03 17:13 EDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000064s latency).
PORT   STATE  SERVICE
80/tcp closed http

Nmap done: 1 IP address (1 host up) scanned in 0.21 seconds
root@kali:~# apache2ctl start
apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1 for ServerName
root@kali:~# nmap -sF 127.0.0.1 -p 80,81

Starting Nmap 6.46 ( http://nmap.org ) at 2014-10-03 17:14 EDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000017s latency).
PORT   STATE         SERVICE
80/tcp open|filtered http
81/tcp closed        hosts2-ns

Nmap done: 1 IP address (1 host up) scanned in 1.46 seconds
root@kali:~# uname -a
Linux kali 3.14-kali1-amd64 #1 SMP Debian 3.14.5-1kali1 (2014-06-07) x86_64 GNU/Linux