Nmap Stealth Scan

Stealth scanning is a primary component of Nmap. When performing an audit of enterprise servers, it’s important to understand stealth scanning techniques. This is because a malicious attacker usually performs a stealth scan, which can be hard to detect. Including stealth scanning in our audits will help us build a better security framework for our clients.

Default stealth scan

The default SYN scan can also be called a stealth scan. This is because the SYN scan doesn’t finish the TCP handshake. A SYN scan (also known as a half-open scan) is performed using the SYN flag in the TCP header. In a SYN scan, Nmap sends a SYN packet to the target host and waits for a response.

Once Nmap receives a response, it drops the connection. This makes it hard for the target to analyze the incoming packets. Please note that using the SYN scan alone doesn’t guarantee stealth mode. There are other flags we can use in combination with the SYN scan to decrease the probability of ...