312-50V10 · Question #48
An attacker scans a host with the below command. Which three flags are set? #nmap -sX host.domain.com
The correct answer is C. This is Xmas scan. URG, PUSH and FIN are set. nmap -sX is the Xmas scan, which sets the FIN, PSH (PUSH), and URG TCP flags simultaneously - named for the 'lit-up' appearance of the flagged packet.
Question
An attacker scans a host with the below command. Which three flags are set? #nmap -sX host.domain.com
Options
- AThis is ACK scan. ACK flag is set
- BThis is Xmas scan. SYN and ACK flags are set
- CThis is Xmas scan. URG, PUSH and FIN are set
- DThis is SYN scan. SYN flag is set
How the community answered
(28 responses)- A4% (1)
- C89% (25)
- D7% (2)
Why each option
nmap -sX is the Xmas scan, which sets the FIN, PSH (PUSH), and URG TCP flags simultaneously - named for the 'lit-up' appearance of the flagged packet.
nmap -sA is the ACK scan that sets only the ACK flag; -sX sets no ACK flag and is not an ACK scan.
The Xmas scan identification is correct, but SYN and ACK are not the flags set; -sX uses URG, PUSH, and FIN, not the SYN/ACK combination associated with handshake or ACK scans.
The -sX flag instructs nmap to send TCP packets with the URG, PUSH, and FIN bits set. Per RFC 793, a closed port should respond with RST, while an open port drops the packet silently - allowing port state inference. The scan is called 'Xmas' because the three set flags resemble blinking lights on a Christmas tree.
nmap -sS is the SYN stealth scan that sets only the SYN flag; -sX is entirely different and sets three flags, none of which is SYN.
Concept tested: nmap Xmas scan TCP flag configuration
Source: https://nmap.org/book/scan-methods-null-fin-xmas-scan.html
Topics
Community Discussion
No community discussion yet for this question.