1

Many resources stated that FIN scan can bypass non-stateful firewall:

In Nmap document:

The key advantage to these scan types is that they can sneak through certain non-stateful firewalls and packet filtering routers.

Also in Wikipedia :

FIN packets can bypass firewalls without modification.

But I don't know which property of FIN scan makes the bypassing possible?

Also I found in an answer to the other question, it mentioned that the FIN scan is an older attack, does it means nowadays FIN scan is much less useful facing the new version firewalls?

1

TCP FIN exploit a subtle loophole in the TCP RFC to differentiate between open and closed ports. Page 65 of RFC 793 says that "if the [destination] port state is CLOSED .... an incoming segment not containing a RST causes a RST to be sent in response." Then the next page discusses packets sent to open ports without the SYN, RST, or ACK bits set, stating that: "you are unlikely to get here, but if you do, drop the segment, and return."

This is indeed an old way to circumvent packet filtering, and the industry has made this scan (mostly) obsolete. Like any other scan, the idea is to try it and see if this works, and compare with other scan type to understand if a port is really close or open.

When scanning systems compliant with this RFC text, any packet not containing SYN, RST, or ACK bits will result in a returned RST if the port is closed and no response at all if the port is open. As long as none of those three bits are included, any combination of the other three (FIN, PSH, and URG) are OK. Nmap exploits this with three scan types:

Null scan ( -sN) Does not set any bits (TCP flag header is 0) FIN scan (-sF) Sets just the TCP FIN bit. Xmas scan ( -sX) Sets the FIN, PSH, and URG flags, lighting the packet up like a Christmas tree.

These three scan types are exactly the same in behavior except for the TCP flags set in probe packets. The key advantage to these scan types is that they can sneak through certain non-stateful firewalls and packet filtering routers. Such firewalls try to prevent incoming TCP connections (while allowing outbound ones) by blocking any TCP packets with the SYN bit set and ACK cleared.

Source: Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning

  • Still a little confused, I thought for the FIN packet to reach the port and exploit the loophole, it needs to pass the firewall first. How does it bypass the packet filter rule? – Sugre Nov 22 '15 at 2:17
  • The firewall let the incoming TCP connection go through if the FIN bit is set. If the port on the targeted computer is closed, you get closed status, if open, you do not get anything back (open/filtered). If you scan with SYN (default) instead of FIN, the firewall would intercept your probe, block it or/and forge a RST even if the port is open on the targeted machine, in this last scenario the scan is a failure as you cannot figure which ports are opened, and which are closed. – Florian Bidabe Nov 22 '15 at 3:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.