> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/active-reconnaissance-approach/nmap/scan-techniques.md).

# Scan Techniques

Scan techniques refer to the **various methods used by Nmap** to discover hosts, networks, and services. These techniques are essential for **network mapping, vulnerability assessment, and penetration testing**. Each scanning method has its own characteristics, advantages, and use cases.

***

### **1. SYN Scan (`-sS`)**

SYN scan, also known as a **half-open scan**, sends an **SYN packet** and waits for a response:

* **SYN/ACK** → Port is **open**
* **RST** → Port is **closed**
* No response → Port is **filtered**

This method is **stealthy** because it does **not complete** the TCP **three-way handshake**.

**Example:**

Scan **all ports** in a subnet:

```bash
nmap -sS -p- 192.168.1.1/24
```

Scan **specific ports** on a domain:

```bash
nmap -v -sS -p 21,22,25,80,443 example.com
```

Perform a **SYN scan without pinging the target**:

```bash
nmap -v -Pn -sS example.com/24
```

***

### **2. Connect Scan (`-sT`)**

Connect scan performs a **full TCP handshake**, making it **easier to detect** by intrusion detection systems (**IDS**).

**Example:**

Scan **all ports** on a subnet:

```bash
nmap -v -sT -p- 192.168.1.1/24
```

Scan **ports 1-100** on a domain:

```bash
nmap -v -sT -p 1-100 example.com
```

Scan **specific ports** on a domain:

```bash
nmap -v -sT -p 80,443,22,21,25,445,69,53 example.com
```

***

### **3. ACK Scan (`-sA`)**

ACK scan helps detect **stateless firewalls** by checking for responses:

* **RST response** → Port is **unfiltered**
* **No response** → Port is **filtered**

**Example:**

Scan **all ports** in a subnet:

```bash
nmap -v -sA -p- 192.168.1.1/24
```

ACK scan without pinging the target:

```bash
nmap -v -sA -Pn example.com
```

***

### **4. Window Scan (`-sW`)**

Similar to ACK scan but uses **TCP Window Size** to determine port states.

**Example:**

Scan a **subnet**:

```bash
nmap -sW 192.168.1.1/24
```

Scan a **domain**:

```bash
nmap -v -sW example.com
```

***

### **5. Maimon Scan (`-sM`)**

Sends a **packet with the URG flag set**. Similar to the **Window scan**, but targets **firewalls that block Window scan packets**.

**Example:**

Scan a **subnet**:

```bash
nmap -sM 192.168.1.1/24
```

Scan a **domain**:

```bash
nmap -v -sM example.com
```

***

### **6. Customize TCP Scan Flags (`--scanflags <flags>`)**

Manually set **custom TCP flags** to bypass firewalls or evade detection.

**Example:**

Use **SYN flag** to scan specific ports:

```bash
nmap -Pn -v --scanflags SYN -p 80,443 example.com
```

***

### **7. UDP Scan (`-sU`)**

Unlike **TCP**, UDP does not require a **handshake**, making it **slower** but useful for scanning **DNS, SNMP, and other UDP services**.

**Example:**

Scan a **target's UDP ports**:

```bash
nmap -sU 192.168.1.1
```

Verbose UDP scan on a **domain**:

```bash
nmap -v -sU example.com
```

***

### **8. Idle Scan (`-sI`)**

Uses a **"zombie" host** to scan the target **stealthily**, making it difficult to trace back to the attacker.

🔹 **Syntax:**

```bash
nmap -sI zombie_host target_host
```

***

### **9. FTP Bounce Scan (`-b`)**

Uses an **FTP server as a proxy** to scan the target, useful for **bypassing firewalls**.

🔹 **Syntax:**

```bash
nmap -b ftp_server target_host
```

***

### **TCP Null, FIN, and Xmas Scans**

These techniques send **malformed packets** to check firewall behaviour and system responses.

#### **1. TCP Null Scan (`-sN`)**

* Sends a **packet with no flags**
* If **no response**, the port is **open**
* If **RST response**, the port is **closed**

**Example:**

```bash
nmap -v -sN -p 80,443 192.168.1.1
```

```bash
nmap -v -sN example.com
```

#### **2. TCP FIN Scan (`-sF`)**

* Sends a **packet with only the FIN flag**
* If **no response**, the port is **open**
* If **RST response**, the port is **closed**

**Example:**

```bash
nmap -v -sF -p- 192.168.1.1
```

```bash
nmap -v -sF -p 80,443 example.com
```

#### **3. Xmas Scan (`-sX`)**

* Sends a **packet with FIN, PSH, and URG flags set**
* If **no response**, the port is **open**
* If **RST response**, the port is **closed**

**Example:**

```bash
nmap -v -sX -p 80,443 192.168.1.1
```

```bash
nmap -v -sX -p 80,443 example.com
```