- Nmap 6：Network exploration and security auditing Cookbook
- Paulino Calderon Pale
- 445字
- 2021-08-05 18:31:05
Discovering hosts with TCP ACK ping scans
Similar to the TCP SYN ping scan, the TCP ACK ping scan is used to determine if a host is responding. It can be used to detect hosts that block SYN packets or ICMP echo requests, but it will most likely be blocked by modern firewalls that track connection states.
The following recipe shows how to perform a TCP ACK ping scan and its related options.
How to do it...
Open a terminal and enter the following command:
# nmap -sP -PA <target>
How it works...
A TCP ACK ping scan works in the following way:
- Nmap sends an empty TCP packet with the ACK flag set to port 80
- If the host is offline, it should not respond to this request
- If the host is online, it returns an RST packet, since the connection does not exist
There's more...
It is important to understand that there will be cases when this technique will not work. Let's launch a TCP ACK ping scan against one of these hosts.
# nmap -sP -PA 0xdeadbeefcafe.com Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn Nmap done: 1 IP address (0 hosts up) scanned in 3.14 seconds
The host is shown as offline, but let's try a TCP SYN ping scan with the same host.
# nmap -sP -PS 0xdeadbeefcafe.com Nmap scan report for 0xdeadbeefcafe.com (50.116.1.121) Host is up (0.090s latency). Nmap done: 1 IP address (1 host up) scanned in 13.24 seconds
We discovered that the host was online, but blocking thos ACK packets.
TCP ACK ping scans need to run as a privileged user, otherwise a system call connect() is used to send an empty TCP SYN packet. Hence, TCP ACK ping scans will not use the TCP ACK technique, previously discussed, as an unprivileged user, and it will perform a TCP SYN ping scan instead.
See also
- The Finding live hosts in your network recipe in Chapter 1, Nmap Fundamentals
- The Discovering hosts with TCP SYN ping scans recipe
- The Discovering hosts with UDP ping scans recipe
- The Discovering hosts with ICMP ping scans recipe
- The Discovering hosts with IP protocol ping scans recipe
- The Discovering hosts with ARP ping scans recipe
- The Discovering hosts using broadcast pings recipe
- The Discovering stateful firewalls by using a TCP ACK scan recipe in Chapter 3, Gathering Additional Host Information
- Mobile Forensics Cookbook
- 黑客大曝光：無線網絡安全（原書第3版）
- 可信計算3.0工程初步
- 等級保護測評理論及應用
- 軟件開發安全之道：概念、設計與實施
- 移動APT：威脅情報分析與數據防護
- Spring Security（Third Edition）
- 從實踐中學習Kali Linux滲透測試
- Advanced Penetration Testing for Highly：Secured Environments（Second Edition）
- Mastering Reverse Engineering
- 網絡用戶行為的安全可信分析與控制
- 網絡安全大數據分析與實戰
- 白話零信任
- 數字政府網絡安全合規性建設指南：密碼應用與數據安全
- Practical Internet of Things Security