GSEC · Question #361
What is the motivation behind SYN/FIN scanning?
The correct answer is B. SYN/FIN packets are commonly used to launch denial of service attacks against BSD hosts. SYN/FIN scanning exploits a known vulnerability in older BSD TCP/IP stack implementations, where receiving a packet with both SYN and FIN flags simultaneously caused system instability or denial of service.
Question
What is the motivation behind SYN/FIN scanning?
Options
- AThe SYN/FIN combination is useful for signaling to certain Trojans.
- BSYN/FIN packets are commonly used to launch denial of service attacks against BSD hosts.
- CThe crafted SYN/FIN packet sometimes gets past firewalls and filtering routers.
- DA SYN/FIN packet is used in session hijacking to take over a session.
How the community answered
(30 responses)- A3% (1)
- B83% (25)
- C7% (2)
- D7% (2)
Why each option
SYN/FIN scanning exploits a known vulnerability in older BSD TCP/IP stack implementations, where receiving a packet with both SYN and FIN flags simultaneously caused system instability or denial of service.
There is no documented technical relationship between SYN/FIN flag combinations and Trojan horse command-and-control signaling mechanisms.
Older BSD-derived TCP/IP stacks did not handle the logically contradictory SYN/FIN flag combination gracefully, making these crafted packets an effective denial of service tool against BSD hosts. The simultaneous assertion of SYN (initiate connection) and FIN (terminate connection) flags is a protocol-illegal state that caused crashes or unexpected behavior in vulnerable BSD network stacks.
While SYN/FIN packets may sometimes pass stateless packet filters, firewall evasion is not the primary documented motivation for SYN/FIN scanning in this context.
Session hijacking relies on sequence number prediction and TCP state manipulation, not on crafted SYN/FIN flag combinations.
Concept tested: SYN/FIN TCP flag scanning and BSD vulnerability
Topics
Community Discussion
No community discussion yet for this question.