‫Up to now, we have seen the most important scanning tapes to discover a network.
‫There are some other scanning techniques in and map which are not used as much as the others.
‫But in some cases you may need to find some other ways to be able to discover the sensitive hosts in
‫a network.
‫In this slide, we'll see three more skin types no fin and Christmas scans.
‫The common ground of these three scanning methods, no fin and Christmas scans is that they send packets
‫to the target systems in which sin, ach and risk flags are not set.
‫No scan, as upper case end does not set any bits.
‫That is, the TCP flag header is zero.
‫Fin scan as uppercase F sets just the TCP fin bit.
‫Christmas scan as Upper Case X sets the fin push and urge flags lighting the packet up like a Christmas
‫tree.
‫There are two rules defined in RF standards about such packet.
‫The first rule is if the destination port state is closed and incoming segment not containing a risk
‫causes a risk to be sent in response.
‫The second rule is packet sent to open ports.
‫Without this in risk or act bit set our drop.
‫These three scan tapes are exactly the same in behavior, except for the TCP flags set in probe packets.
‫If a risk packet is received, the port is considered closed, while no response means it is open or
‫filtered.
‫If an ICMP unreachable error, type three code zero one, two, three, nine, 10 or 13 is received.
‫The port is marked as filtered, so as a result, with these types of scans, you can find out if a
‫port is closed or not.
‫It's not possible to understand if it's open or filtered if there's no response.
‫This scan is different than the others discussed so far in that it never determines open or even open
‫filtered ports.
‫It's used to map out firewall rules set, determining whether they're stateful or not and which ports
‫are filtered.
‫The Acts scan probe packet has only the EC flag set.
‫When scanning unfiltered systems, open and closed ports will both return a receipt packet.
‫And map and labels him as unfiltered, meaning that they are reachable by the act packet.
‫But whether or not they're open or closed is undetermined.
‫Ports that don't respond or send certain ICMP error messages back.
‫Type three code zero one two three nine 10 were 13 are labeled filter.