A penetration tester is performing a port scan that is configured to detect open TCP ports without completing the full TCP three-way handshake. Which Nmap option should the tester use to perform this type of scan?
The -sS option in Nmap initiates a SYN scan, also known as a stealth scan. This type of scan sends a SYN packet, as if it is going to open a connection and then waits for a response. A SYN/ACK response indicates that the port is open. This method is considered 'stealthy' because it does not complete the three-way handshake and is less likely to be logged. On the other hand, options like -sT (TCP connect scan) establish a full connection, -sU (UDP scan) is used for scanning UDP ports, and -A enables OS detection, version detection, script scanning, and traceroute, which is not specifically related to stealth scanning.
Learn More
AI Generated Content may display inaccurate information, always double-check anything important.
What are the advantages of using a SYN scan over a TCP connect scan?