Stealth scans

A stealth scan (sometimes known as a half open scan) is much like a full open scan with a minor difference that makes it less suspicious on the victim's device. The primary difference is that a full TCP three-way handshake does not occur. Looking at the following diagram, the initiator (device A) would send a TCP SYN packet to device B for the purpose of determining whether a port is open. Device B will respond with a SYN/ACK packet to the initiator (device A) if the port is open. Next, device A will send an RST to terminate the connection. If the port is closed, device B will sent an RST packet:

Stealth scan showing open and closed service ports

The benefit of using this type of scan is that it reduces the chances of being detected.

To execute a stealth scan, select (TCP SYN) from the list in the nmap window in the NetHunter app and enter the target IP address:

Selection of TCP SYN