312-50V9 · Question #320
Which of the following will perform an Xmas scan using NMAP?
The correct answer is C. nmap -sX 192.168.1.254. The NMAP Xmas scan uses the -sX flag, which sets the FIN, PSH, and URG TCP flags simultaneously to probe for open and closed ports.
Question
Which of the following will perform an Xmas scan using NMAP?
Options
- Anmap -sA 192.168.1.254
- Bnmap -sP 192.168.1.254
- Cnmap -sX 192.168.1.254
- Dnmap -sV 192.168.1.254
How the community answered
(23 responses)- A4% (1)
- B4% (1)
- C91% (21)
Why each option
The NMAP Xmas scan uses the -sX flag, which sets the FIN, PSH, and URG TCP flags simultaneously to probe for open and closed ports.
nmap -sA performs a TCP ACK scan used to map firewall rule sets, not an Xmas scan.
nmap -sP performs a ping scan (host discovery) to determine which hosts are online, not an Xmas scan.
The nmap -sX flag performs an Xmas scan by setting the FIN, PSH, and URG flags in the TCP packet header, lighting up the packet 'like a Christmas tree.' Per RFC 793, a closed port should respond with a RST, while an open port drops the packet with no response, allowing port state inference. This scan can bypass some stateless packet filters that do not track TCP connection state.
nmap -sV performs version detection against open ports to identify running service versions, not an Xmas scan.
Concept tested: NMAP Xmas scan flag and TCP probe behavior
Source: https://nmap.org/book/man-port-scanning-techniques.html
Topics
Community Discussion
No community discussion yet for this question.