A penetration tester is performing a port scan that is configured to detect open TCP ports without completing the full TCP three-way handshake. Which Nmap option should the tester use to perform this type of scan?
The -sS option in Nmap initiates a SYN scan, also known as a stealth scan. This type of scan sends a SYN packet, as if it is going to open a connection and then waits for a response. A SYN/ACK response indicates that the port is open. This method is considered 'stealthy' because it does not complete the three-way handshake and is less likely to be logged. On the other hand, options like -sT (TCP connect scan) establish a full connection, -sU (UDP scan) is used for scanning UDP ports, and -A enables OS detection, version detection, script scanning, and traceroute, which is not specifically related to stealth scanning.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is the TCP three-way handshake?
Open an interactive chat with Bash
What are the advantages of using a SYN scan over a TCP connect scan?