nerdexam
GIAC

GCIH · Question #20

Adam, a malicious hacker is running a scan. Statistics of the scan is as follows: Scan directed at open port: ClientServer 192.5.2.92:4079 ---------FIN--------->192.5.2.110:23192.5.2.92:4079 <----NO…

The correct answer is B. FIN scan. The scan sends only a FIN packet; an open port silently drops it with no response, while a closed port replies with RST/ACK - this behavior precisely defines a FIN scan.

Reconnaissance, Scanning, and Enumeration

Question

Adam, a malicious hacker is running a scan. Statistics of the scan is as follows:

Scan directed at open port: ClientServer 192.5.2.92:4079 ---------FIN--------->192.5.2.110:23192.5.2.92:4079 <----NO RESPONSE--- ---192.5.2.110:23 Scan directed at closed port:

ClientServer 192.5.2.92:4079 ---------FIN--------->192.5.2.110:23 192.5.2.92:4079<-----RST/ACK----------192.5.2.110:23 Which of the following types of port scan is Adam running?

Options

  • AACK scan
  • BFIN scan
  • CXMAS scan
  • DIdle scan

How the community answered

(33 responses)
  • A
    3% (1)
  • B
    82% (27)
  • C
    3% (1)
  • D
    12% (4)

Why each option

The scan sends only a FIN packet; an open port silently drops it with no response, while a closed port replies with RST/ACK - this behavior precisely defines a FIN scan.

AACK scan

An ACK scan sends packets with the ACK flag set to determine firewall filtering rules, not FIN packets, and evaluates RST vs. no-response to classify ports as filtered or unfiltered.

BFIN scanCorrect

A FIN scan exploits RFC 793 TCP behavior by sending a packet with only the FIN flag set to a target port. According to the spec, a closed port must respond with RST/ACK, while an open port has no defined response and silently drops the unexpected FIN. This asymmetry - no response means open, RST/ACK means closed - is exactly what the scan statistics show, confirming this is a FIN scan.

CXMAS scan

An XMAS scan sets the FIN, PSH, and URG flags simultaneously on the probe packet, not just the FIN flag alone.

DIdle scan

An idle scan uses a third-party zombie host's IP ID counter to infer port states indirectly and does not send FIN packets directly from the attacker.

Concept tested: FIN scan behavior on open vs. closed ports

Source: https://nmap.org/book/man-port-scanning-techniques.html

Topics

#FIN scan#TCP flags#port scanning techniques#traffic analysis

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice