📖 What is Xmas Scan?
An Xmas Scan is a network scanning technique that sets the FIN, PSH, and URG flags in the TCP header, making the packet 'lit up like a Christmas tree.' It is used to identify open ports on systems that follow RFC 793.
"Be aware that Xmas scans are largely ineffective against Windows systems, which typically respond with a RST packet regardless of whether the port is open or closed."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Xmas Scan?
- ▸ Utilizes a specific combination of TCP flags—FIN, PSH, and URG—to probe ports without initiating a full three-way handshake.
- ▸ Relies on RFC 793 specifications, where closed ports respond with a RST packet, while open ports typically ignore the request.
- ▸ Serves as a stealth mechanism to bypass basic stateful firewalls or packet filters that specifically monitor for SYN packets.
- ▸ Provides critical data for OS fingerprinting, as the response behavior varies significantly between Unix-based systems and Microsoft Windows.
- ▸ Produces 'Open|Filtered' results because the lack of a response could indicate either an open port or a blocking firewall.
🎯 How does Xmas Scan appear on the PT0-002 Exam?
You may be asked to identify the most effective scanning technique when a target firewall is configured to drop all incoming TCP SYN packets, requiring a stealthier approach like an Xmas scan to elicit responses.
A scenario might describe a packet capture showing TCP packets with the FIN, PSH, and URG flags set; you must identify this as an Xmas scan used for reconnaissance.
Expect questions where you must analyze Nmap output showing 'Open|Filtered' and determine why this result occurs during an Xmas scan, specifically regarding the lack of response from an open port.
❓ Frequently Asked Questions
How does an Xmas scan differ from a Null scan?
Both are stealth scans that avoid the SYN flag to bypass filters. However, a Null scan sends a packet with no flags set at all, whereas an Xmas scan sets the FIN, PSH, and URG flags.
Why is the Xmas scan considered ineffective against Windows targets?
Windows systems do not strictly follow RFC 793 for these packets; they typically send a RST response regardless of whether the port is open or closed, making it impossible to determine the port state.
What is the significance of the 'Open|Filtered' result in Nmap?
Because an open port ignores the Xmas packet, Nmap cannot distinguish between a port that is actually open and one where a firewall dropped the packet entirely, leading to this ambiguous classification.