Introduction to advanced scanning technology and principles (2)

Ii. Advanced TCP Scanning Technology

The most basic use of TCP scanning is the use of connect (), which is easy to achieve. If the target host can connect, it indicates that a corresponding port is opened. However, this is also the most primitive and the first type to be rejected by protection tools.

In advanced TCP scanning technology, the three-way handshake feature of TCP connections is used, that is, half-open scanning. These methods can bypass some firewalls and obtain the host information behind the firewalls. Of course, it is not spoofed. Another advantage of the following methods is that they are hard to be recorded. Some methods cannot be displayed even when using the netstat command. SYN

Send a TCP datagram with only the SYN flag to a port of the remote host. If the host reports a syn ack packet, the host is listening to the port. If the response is an RST packet, the host does not listen on this port. There is a SYN option on X-ray.

ACK

Send a TCP datagram with only the ACK flag to the host. If the host reports a tcp rst datagram, the host exists.

FIN

Send a tcp fin datagram to the remote host. If the host does not provide any feedback, the host exists and is listening for this port. If the host returns a tcp rst, it indicates that the host exists but does not listen for this port.

NULL

That is, a TCP packet without any flag is sent. According to RFC793, if the corresponding port of the target host is disabled, an RST packet should be sent back.

FIN + URG + PUSH

Send a Fin, URG, and PUSH group to the target host. According to RFC793, if the corresponding port of the target host is disabled, an RST flag should be returned.