Ethical Hacking and Penetration Testing Guide

105
FIN Scan
Source
192.168.0.8
Destination
192.168.0.7
FIN + Port 23
A FIN flag is used to close a currently open session. In a FIN scan the sender sends a FIN flag 
to the target machine: if no response comes from the target machine, it means that the port is 
open
; if the target machine responds with a 
RST
, it means that the port is 
closed
.
Command_:_nmap_–sF_XMAS_Scan'>Command
:
nmap –sF
XMAS Scan
Source
192.168.0.8
Destination
192.168.0.7
FIN, URG, PUSH + Port 79
The XMAS scan sends a combination of FIN, URG, and PUSH flags to the destination. It 
lightens the packet just like a Christmas tree and that is why it is called an XMAS scan. It works 
just like the FIN and null scans. If there is 
no
response, the port is 
open
; if the target machine 
responds with a 
RST
packet, the port is 
closed
.
Command
:
nmap –sX
TCP ACK Scan
Source
69.240.103.51
Destination
68.46.234.161
RST
TCP ACK + Port 6969
The TCP ACK scan is not used for port scanning purposes. It is commonly used to determine 
the firewall and ACL rules (access list) and whether the firewall is able to keep track of the con-
nections that are being made.

---

106
◾ 
Ethical Hacking and Penetration Testing Guide
The way this works is that the source machine sends an acknowledge 
(ack)
packet instead of a 
syn packet. If the firewall is stateful, it would know that the there was no SYN packet being sent 
and will not allow the packet to reach the destination.
Responses
◾
If there is no response, this means that the firewall is stateful and it’s filtering your packets.
◾
If you receive a reset packet, it means that the packet reached the destination.
The capture from wireshark also gives a better insight into the TCP ACK scan.