1

While studying Nmap, I came across different port scans. Out of these XMAS and FIN scan caught my interest. Though XMAS scan sends FIN, URG and RST flags, the response is the same as that of a FIN scan, which only sends a FIN packet.

How do I decide when to use XMAS or FIN scans when both have the same response and same limitations?

0

The nmap documentation states the following for NULL, FIN and Xmas scans:

When scanning systems compliant with this RFC text, any packet not containing SYN, RST, or ACK bits will result in a returned RST if the port is closed and no response at all if the port is open. As long as none of those three bits are included, any combination of the other three (FIN, PSH, and URG) are OK. Nmap exploits this with three scan types

As you can see, if the port is open no response would be returned. This may work in ideal scenarios, but you might be scanning through a firewall that may be blocking access to certain services.

For example, you have a web application on port 80 that should be accesible for everyone but you don't want everyone to be able to access your ssh port, so configure the firewall to drop packets with the SYN flag to port 22 if it's not from an authorized IP and respond a RST

In this example, using a scan with the SYN flag will return a RST which means the port is closed. Instead, if we use a NULL scan for example - that doesn't have the SYN flag - won't be dropped by the firewall and will return RST if the port is closed or nothing if it's open.

How do I decide when to use XMAS or FIN scans when both have the same response and same limitations?

In most cases those scans should work the same, the only reason I can think of to chose one over another is to bypass certain firewall filters. In the previous example, the firewall may also drop packets from a NULL scan since there is no flags in it, therefore interpreting it as corrupted packet. In this case you should use a scan that has some flags on but that it doesn't contain the SYN flag, like FIN or Xmas scans

Note that you won't be able to know if the port is actually open if you receive no response as it's also possible that the firewall drops the RST response when a port is closed, therefore misinterpreting it as open when it's not. For this kind of scans to work properly you should have some previous knowledge of how the server responds to those kind of scans using a port for which know the exact state (In our example it could be port 80) and analyze the different responses for every scan type

1

NULL, FIN, and Xmas scans all send packets without SYN, ACK, or RST flags. They should all get the same responses, according to the RFC, but different implementations may treat them differently. If you want to use one, it's best to find one open and one closed port by some other means (such as open source intelligence gathering) and then test each of the scan types against those ports only. Whichever one(s) give the correct output can be used to further scan the system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.