312-50V10 · Question #491
While doing a technical assessment to determine network vulnerabilities, you used the TCP XMAS scan. What would be the response of all open ports?
The correct answer is C. The port will ignore the packets. In a TCP XMAS scan, open ports do not respond to the specially crafted packets, while closed ports reply with an RST - the absence of a response identifies an open port.
Question
While doing a technical assessment to determine network vulnerabilities, you used the TCP XMAS scan. What would be the response of all open ports?
Options
- AThe port will send an ACK
- BThe port will send a SYN
- CThe port will ignore the packets
- DThe port will send an RST
How the community answered
(28 responses)- A4% (1)
- B4% (1)
- C82% (23)
- D11% (3)
Why each option
In a TCP XMAS scan, open ports do not respond to the specially crafted packets, while closed ports reply with an RST - the absence of a response identifies an open port.
An ACK packet is sent as part of an established TCP session or in response to a SYN during the three-way handshake, not as a reaction to XMAS scan flag combinations on open ports.
A SYN packet initiates a new TCP connection handshake and is sent by the client, not generated by a server port in response to an XMAS scan probe.
A TCP XMAS scan sends packets with the FIN, PSH, and URG flags all set simultaneously. Per RFC 793, a TCP implementation on an open port will silently drop any incoming segment that does not match an active connection state, producing no response. This lack of response is the signal an XMAS scan uses to infer that the port is open.
An RST packet is the response generated by CLOSED ports when they receive unexpected or out-of-state XMAS scan packets, which is the opposite behavior from open ports.
Concept tested: TCP XMAS scan behavior on open vs closed ports
Source: https://nmap.org/book/scan-methods-null-fin-xmas-scan.html
Topics
Community Discussion
No community discussion yet for this question.