CompTIA PenTest+ (PT0-003)Post-exploitation and Lateral MovementMedium
A penetration tester has compromised an internal workstation and needs to scan other hosts in the same network segment. However, the workstation's firewall blocks all outbound TCP connections except for established ones. Which Nmap scan type is most likely to succeed in this scenario by leveraging existing connections or being less intrusive?
- ANmap -sT (TCP Connect Scan)
- BNmap -sA (ACK Scan)
- CNmap -sN (Null Scan)
- DNmap -sS (SYN Stealth Scan)
Show answer & explanationAnswer & explanation
Correct answer: B. Nmap -sA (ACK Scan)
An Nmap ACK scan (-sA) sends only an ACK packet. If a non-filtered port responds with an RST, it indicates the port is either open or closed, but not filtered by a stateful firewall. If no response or an ICMP Destination Unreachable is received, the port is likely filtered. This can help map firewall rules without initiating a full connection, which would be blocked by the 'established connections only' rule.
Why the other options are wrong
- A. TCP Connect scan initiates a full TCP handshake, which would also be blocked by the firewall.
- C. Null scan (and other Xmas/FIN scans) are designed for stealth but are often blocked by modern stateful firewalls; they are also less reliable for determining open ports than ACK scans for firewall mapping.
- D. SYN scan initiates a new connection, which would be blocked by the firewall as it's not an established connection.
Nmap ACK Scan (-sA)
An Nmap scan type that sends only an ACK packet to the target port. It is used to determine if a port is 'filtered' by a firewall or 'unfiltered' (open or closed), without attempting to establish a full connection.
- Does not determine if a port is open, only if it's filtered or unfiltered.
- Useful for mapping firewall rules and identifying stateful firewalls.
- A non-filtered port will respond with an RST; a filtered port will drop the packet or send ICMP error.
Memory trick: ACK scans ACK-nowledge the firewall's presence.