Hack$Notes
  • Hack$Notes
  • Enumeration
    • NMAP Scanning
    • Hping3 Scanning
      • IDLE SCAN
    • DNS Enum
    • SMB Enum
    • SMTP Enum
    • POP3
    • SNMP Enum
    • LDAP Enum
    • HTTP Enum
      • CheckList
    • FTP Enum
    • SSH Enum
    • MySQL Enum
    • Oracle Enum
    • NFS Enum
    • Internet Relay Chat (IRC)
    • Telnet
    • Kerberos
    • Finger
    • Ports Open/Close
    • ident
    • Postgresl
  • Transferring Files
  • Metasploit Framework
    • Msfvenom tutorial
    • Msfvenom Payloads
  • Reverse Shells
  • Buffer Overflow
    • B.O Steps
    • SLmail B.O
  • Spawning a Shell
  • Password Attacks
    • Passing the Hash
    • SAM/SYSTEM
    • Passwords
    • Hydra
    • Medusa
    • Ncrack
    • Unshadow
    • Hashcat
    • John The Ripper
    • fcrackzip
  • Privilege Escalation
    • Windows
      • Kernel Exploits
      • Stored Credentials
      • Unquoted Service Path
      • Always Install Elevated
      • Weak Permissions
      • Schedule Tasks
      • AutoRun Executables
      • Startup Apps
      • Passwords
      • Win PrivEsc Tools
    • Linux
      • Kernel Exploits
      • Service Exploits
      • PATH Variable
      • SUID/GUID files
      • CronJobs
      • Sudo
      • Custom Executable
      • Linux PrivEsc Tools
  • Port Forwarding
  • Tools / Techniques
    • General Check List
    • Misc. Commands
    • Steganography
    • Evasion Techniques
    • SQL Injection Payloads
    • LFI / RFI
    • Recover contents
    • JAR Files
    • Strace/Ltrace
    • Port Knocking
    • Screenshots in Kali
    • Curl
  • Resources
    • Books
    • Links
Powered by GitBook
On this page
  • TCP Connect
  • Stealth Scan(Half Open)
  • Inverse TCP flag
  • Xmas Scan
  • Null Scan
  • ACK flag Probe Scanning
  • IDLE Scan(sends packets from IDLE zombie)
  • UDP Scanning(No flags sent, No 3-way Handshake made)
  • FIN Scanning
  • ACK Scanning

Was this helpful?

  1. Enumeration

Ports Open/Close

With BOLD is the attacker/client send flags

TCP Connect

open: SYN, SYN/ACK, ACK, RST

close: SYN, RST

Stealth Scan(Half Open)

open: SYN, SYN/ACK, RST

close: SYN, RST

Inverse TCP flag

open: FIN/URG/PSH/NULL, No Response

close: FIN/URG/PSH/NULL, RST/ACK

Xmas Scan

open: FIN+URG+PSH, No Response

close: FIN+URG+PSH, RST/ACK

Null Scan

open: No Response

close: RST

ACK flag Probe Scanning

Attacker/client sends only ACK package. If he receives on RST flag that means the port is there and open. Also on "NO RESPONSE" means that a stateful firewall is present. On a RST flag means no firewall is in place.

IDLE Scan(sends packets from IDLE zombie)

UDP Scanning(No flags sent, No 3-way Handshake made)

open: No Response

close: ICMP port unreadable UDP port scanning is often unreliable, as firewalls and routers may drop ICMP packets. This can lead to false positives in your scan, and you will regularly see UDP port scans showing all UDP ports open on a scanned machine. People often forget to scan for UDP services, and stick only to TCP scanning, thereby seeing only half of the equation.

FIN Scanning

open: No Response

close: RST

ACK Scanning

open: RST

close: No Response

PreviousFingerNextident

Last updated 4 years ago

Was this helpful?