Some explanation on Maimon Scan

Question

I'm facing this question:

When could the Maimon Scan be usefull?

As I had no idea of what it was, I went into Nmap's manual and saw the explanation:

The Maimon scan is named after its discoverer, Uriel Maimon. He described the technique in Phrack Magazine issue #49 (November 1996). Nmap, which included this technique, was released two issues later. This technique is exactly the same as NULL, FIN, and Xmas scans, except that the probe is FIN/ACK. According to RFC 793 (TCP), a RST packet should be generated in response to such a probe whether the port is open or closed. However, Uriel noticed that many BSD-derived systems simply drop the packet if the port is open.

So, what I understand from this is that, many BSD-derived systems just drop the packet instead of sending an RST back so using the Maimon Scan would set that port as Open, right?

If that's correct, then, I don't get why asking such question. I mean, it would always be very usefull using it against BSD-derived systems, right?

Answer 1

The scan does not open the port, it tests if the port is open or not.

This is useful for enumeration, it can not only help enumerate that the target host may be a BSD derived system, but that the port that is being targeted is open, which you can tell by the absence of a reply.

For example.

If you send FIN/ACK to a port then the port should reply with a RST as the FIN/ACK is out of state or the port is closed, but if you do not get such a reply then it may indicate that the target host is a BSD system and the port is open, as it has been observed that many BSD derived system simply drop the segment if received on an open port.