Context
I'm very familiar with different applications of scanning tools (. . . and you can use -mtu to specify the size of the fragments in nmap . . .) but every piece of information I read about scanning and enumeration seems to always conclude with " . . . but this is only effective against old or poorly configured firewalls . . ."
Question
Where can I get information about some of the more advanced scanning techniques that would be effective against modern, well-configured firewalls?
Post-script
. . . or at least some information on the order of: "regardless of the firewall's configuration or age, X, Y, Z will at the very least give you information about S, R, T, which can be used to discern L, M, and N"
I'm looking for a resource primarily. Books cost $$ and I understand that, so I'm not anti-books.