312-50 Question 275
Single answer▪ IDS/Firewall Evading ToolsDuring an authorized internal penetration test, you discover that a stateful firewall and IDS are aggressively flagging and blocking your SYN scans against a Linux web server in a segmented network. You still need to identify whether TCP ports 22, 80, and 443 are open, but you want to reduce the likelihood of IDS signatures triggering on a normal half-open scan. Which approach is the most appropriate to try first for this goal?
- A
Use Nmap ACK scan (-sA) against the target ports to determine whether they are open
- B
Use Nmap NULL/FIN/Xmas style probing (for example, -sN, -sF, or -sX) because some packet filters and older rule sets may not handle these probes well
- C
Use Nmap UDP scan (-sU) on ports 22, 80, and 443 because UDP scanning is less visible to IDS than TCP scanning
- D
Use full TCP connect scan (-sT) because completing the three-way handshake is less likely to be detected than a SYN scan
Show answer and explanation
Correct answer: B
Explanation
The best answer is the use of NULL/FIN/Xmas-style scans. In CEH-relevant practice, these are recognized as techniques that may help evade simplistic packet filters or older IDS signatures that focus on standard SYN-based scanning behavior. Nmap documents these scan types as useful in certain cases, particularly on RFC 793-style TCP/IP stacks, where closed ports respond with RST while open ports may ignore the probe. This behavior is more applicable to many Unix/Linux systems than to Windows, which is why the Linux target in the scenario matters. By contrast, ACK scans are useful for firewall rule mapping rather than open-port discovery, UDP scans do not test TCP services, and TCP connect scans are typically more detectable because they establish full connections. As a best practice, ethical hackers should choose the scan type that matches the assessment goal, the target OS, and the control being encountered, while staying within authorization and rules of engagement. References: Nmap Network Scanning documentation on TCP NULL, FIN, and Xmas scans; Nmap reference guide for ACK scan behavior and TCP connect scan characteristics.
- A. Incorrect.
Incorrect. An ACK scan (-sA) is primarily used to map firewall rule behavior and determine whether ports appear filtered or unfiltered; it does not reliably tell you whether a TCP port is open or closed. A candidate might choose this because ACK scans are associated with firewall analysis, but they are not the best first choice when the objective is to identify open services on specific TCP ports.
- B. Correct.
Correct. NULL, FIN, and Xmas scans are classic IDS/firewall evasion-related techniques because they send unusual TCP flag combinations instead of a standard SYN. On some systems and older stateless filters, these probes can slip past simplistic rules or trigger fewer signatures than a basic SYN scan. They are not universally effective, especially against modern stateful devices and Windows hosts, but for a Linux target they are a reasonable first alternative when SYN scans are being blocked.
- C. Incorrect.
Incorrect. UDP scanning (-sU) is not appropriate for determining whether TCP ports 22, 80, and 443 are open, because those services normally listen on TCP. This distractor targets the misconception that 'different protocol equals stealth,' but switching to UDP would not answer the actual question about TCP service availability.
- D. Incorrect.
Incorrect. A full TCP connect scan (-sT) usually generates more obvious logs because it completes the three-way handshake and often results in application-layer logging in addition to network monitoring. Someone might pick this thinking a normal connection looks legitimate, but in practice it is generally less stealthy than a SYN scan, not more.