FIN Port Scanners
FIN Port Scanners are my favorite type of port scanners. They send a single packet containg the FIN flag. If the remote host returns a RST flag then the port is closed, if no RST flag is returned, then it is open and listening.
Some port scanners also use the technique of sending a ACK packet and if the Time To Live or ttl of the returning packets is lower than the RST packets received (earlier), or if the windows size is greater than zero, then the port is probably open and listening.
The Following is the code of a supposedly Stealth Port Scanner which appeared in the Phrack Magazine.
/* * scantcp.c * * version 1.32 * * Scans for listening TCP ports by sending packets to them and waiting for * replies. Relys upon the TCP specs and some TCP implementation bugs found * when viewing tcpdump logs. * * As always, portions recycled (eventually, with some stops) from n00k.c
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment