Port Scanning Techniques

Ghosstless offers a range of survey techniques to suit different audit scenarios and privilege levels.

• -sS (TCP SYN Stealth Scan): That's the most popular and default scanning. Send an SYN package as if to open a connection and wait for an answer. If you get SYN / ACK, the port's open. Immediately responded with an RST package to close the link without complete handshake, so it's rarely registered with an application login. It requires administrative privileges.
• -sT (TCP Connect Scan): Use system call connect() Operating system standard. It's the default method when the user doesn't have root privileges. Complete the complete three-way handshake.
• -sU (UDP Scan): It scans ports using UDP protocol (as DNS 53, SNMP 161, DHCP 67 / 68). Since UDP doesn't have an acceptance of a connection receipt, rejected packages can mean that the port's open or leaked.
• -sN, -sF, -sX (Null, FIN, Xmas Scans): They send packages with abnormal combinations of TCP flags (no flag at Null, only FIN at FIN, or FIN + pSH + URG at Xmas). According to RFC 793, closed ports respond with RST while open ports simply discard the package, allowing them to avoid simple nonstate firewalls.
• -sA (TCP ACK Scan): Send packets with an activated ACK flag. It's used to discover sets of firewall rules and to determine which ports are leaked by rules with or without status.
• -sI < zombie host > (Itle Scan): It allows a completely blind and anonymous scanning using IP ID number generation sequences into an intermediate zombie machine.