nerdexam
GIAC

GPEN · Question #93

John works as an Ethical Hacker for uCertify Inc. He wants to find out the ports that are open in uCertify's server using a port scanner. However, he does not want to establish a full TCP connection.

The correct answer is D. TCP SYN. TCP SYN scanning (half-open scanning) sends a SYN packet and never completes the three-way handshake, allowing port discovery without a full TCP connection.

Vulnerability Discovery & Scanning

Question

John works as an Ethical Hacker for uCertify Inc. He wants to find out the ports that are open in uCertify's server using a port scanner. However, he does not want to establish a full TCP connection. Which of the following scanning techniques will he use to accomplish this task?

Options

  • ATCP FIN
  • BXmas tree
  • CTCP SYN/ACK
  • DTCP SYN

How the community answered

(45 responses)
  • A
    4% (2)
  • B
    11% (5)
  • C
    2% (1)
  • D
    82% (37)

Why each option

TCP SYN scanning (half-open scanning) sends a SYN packet and never completes the three-way handshake, allowing port discovery without a full TCP connection.

ATCP FIN

TCP FIN scanning sends a FIN packet to provoke a RST from closed ports, which is a different stealth technique and does not involve SYN-based half-open behavior.

BXmas tree

Xmas tree scanning sets the FIN, PSH, and URG flags simultaneously to elicit responses from closed ports, making it a distinct method unrelated to half-open connections.

CTCP SYN/ACK

TCP SYN/ACK is a reply packet sent by an open port during the handshake, not an active scanning technique initiated by the scanner.

DTCP SYNCorrect

TCP SYN scanning works by sending a SYN packet to a target port and waiting for a response. If the port is open, the target replies with SYN/ACK, but the scanner immediately sends a RST to tear down the connection before it is fully established. This avoids completing the three-way handshake, meaning no full TCP connection is ever logged.

Concept tested: TCP SYN half-open port scanning technique

Source: https://nmap.org/book/synscan.html

Topics

#TCP SYN scan#half-open scan#stealth scanning#port scanning

Community Discussion

No community discussion yet for this question.

Full GPEN Practice