The nmap documentation states the following for
When scanning systems compliant with this RFC text, any packet not containing SYN, RST, or ACK bits will result in a returned RST if the port is closed and no response at all if the port is open. As long as none of those three bits are included, any combination of the other three (FIN, PSH, and URG) are OK. Nmap exploits this with three scan types
As you can see, if the port is open no response would be returned. This may work in ideal scenarios, but you might be scanning through a firewall that may be blocking access to certain services.
For example, you have a web application on port 80 that should be accesible for everyone but you don't want everyone to be able to access your ssh port, so configure the firewall to drop packets with the
SYN flag to port 22 if it's not from an authorized IP and respond a
In this example, using a scan with the
SYN flag will return a
RST which means the port is closed. Instead, if we use a
NULL scan for example - that doesn't have the
SYN flag - won't be dropped by the firewall and will return
RST if the port is closed or nothing if it's open.
How do I decide when to use XMAS or FIN scans when both have the same response and same limitations?
In most cases those scans should work the same, the only reason I can think of to chose one over another is to bypass certain firewall filters. In the previous example, the firewall may also drop packets from a
NULL scan since there is no flags in it, therefore interpreting it as corrupted packet. In this case you should use a scan that has some flags on but that it doesn't contain the
SYN flag, like
Note that you won't be able to know if the port is actually open if you receive no response as it's also possible that the firewall drops the
RST response when a port is closed, therefore misinterpreting it as open when it's not. For this kind of scans to work properly you should have some previous knowledge of how the server responds to those kind of scans using a port for which know the exact state (In our example it could be port 80) and analyze the different responses for every scan type