Task 8 - NULL, FIN and Xmas

Task 8 Scan Types NULL, FIN and Xmas

Which of the three shown scan types uses the URG flag?

It's referred to as an xmas scan as the flags that it sets (PSH, URG and FIN)

Reveal Flag 🚩

🚩xmas

Why are NULL, FIN and Xmas scans generally used?

That said, the goal here is, of course, firewall evasion. Many firewalls are configured to drop incoming TCP packets to blocked ports which have the SYN flag set (thus blocking new connection initiation requests). By sending requests which do not contain the SYN flag, we effectively bypass this kind of firewall.

Reveal Flag 🚩

🚩Firewall Evasion

Which common OS may respond to a NULL, FIN or Xmas scan with a RST for every port?

In particular Microsoft Windows (and a lot of Cisco network devices) are known to respond with a RST to any malformed TCP packet -- regardless of whether the port is actually open or not.

Reveal Flag 🚩

🚩Microsoft Windows