A Firewall Can Take Several Actions When Handling Packets

• Nmap Security Scanner
  • Ref Guide
  • Install Guide
  • Download
  • Changelog
  • Volume
  • Docs
• Npcap packet capture library
  • User's Guide
  • API docs
  • Download
  • Changelog
• Security Lists
  • Nmap Announce
  • Nmap Dev
  • Bugtraq
  • Full Disclosure
  • Pen Test
  • Basics
  • More
• Security Tools
  • Password inspect
  • Sniffers
  • Vuln scanners
  • Web scanners
  • Wireless
  • Exploitation
  • Bundle crafters
  • More
• Site News
• Advertising
• About/Contact
• Sponsors:

Intro Reference Guide Book Install Guide Download Changelog Zenmap GUI Docs Bug Reports OS Detection Propaganda Related Projects In the Movies In the News

Nmap Network Scanning

Firewall/IDS Evasion and Spoofing
	Affiliate 15. Nmap Reference Guide

---

Firewall/IDS Evasion and Spoofing

Many Internet pioneers envisioned a global open up network with a universal IP accost space allowing virtual connections between whatsoever two nodes. This allows hosts to act every bit true peers, serving and retrieving information from each other. People could access all of their domicile systems from work, changing the climate command settings or unlocking the doors for early on guests. This vision of universal connectivity has been stifled by address space shortages and security concerns. In the early 1990s, organizations began deploying firewalls for the express purpose of reducing connectivity. Huge networks were cordoned off from the unfiltered Cyberspace by application proxies, network address translation, and packet filters. The unrestricted flow of information gave way to tight regulation of approved communication channels and the content that passes over them.

Network obstructions such as firewalls tin brand mapping a network exceedingly difficult. It will not get any easier, as stifling casual reconnaissance is oft a key goal of implementing the devices. Nevertheless, Nmap offers many features to help understand these complex networks, and to verify that filters are working as intended. Information technology even supports mechanisms for bypassing poorly implemented defenses. One of the best methods of understanding your network security posture is to endeavor to defeat it. Identify yourself in the mind-set of an attacker, and deploy techniques from this section against your networks. Launch an FTP bounce browse, idle scan, fragmentation attack, or try to tunnel through ane of your own proxies.

In add-on to restricting network activity, companies are increasingly monitoring traffic with intrusion detection systems (IDS). All of the major IDSs send with rules designed to detect Nmap scans because scans are sometimes a precursor to attacks. Many of these products have recently morphed into intrusion prevention systems (IPS) that actively block traffic deemed malicious. Unfortunately for network administrators and IDS vendors, reliably detecting bad intentions past analyzing package information is a tough problem. Attackers with patience, skill, and the assist of certain Nmap options can ordinarily pass past IDSs undetected. Meanwhile, administrators must cope with large numbers of false positive results where innocent activity is misdiagnosed and alerted on or blocked.

Occasionally people suggest that Nmap should not offering features for evading firewall rules or sneaking by IDSs. They argue that these features are just as likely to be misused past attackers as used by administrators to enhance security. The problem with this logic is that these methods would still exist used by attackers, who would merely detect other tools or patch the functionality into Nmap. Meanwhile, administrators would find it that much harder to do their jobs. Deploying but modern, patched FTP servers is a far more powerful defense than trying to forbid the distribution of tools implementing the FTP bounce attack.

In that location is no magic bullet (or Nmap selection) for detecting and subverting firewalls and IDS systems. Information technology takes skill and feel. A tutorial is across the scope of this reference guide, which merely lists the relevant options and describes what they do.

-f (fragment packets); --mtu (using the specified MTU)

The -f option causes the requested scan (including host discovery scans) to utilise tiny fragmented IP packets. The idea is to dissever the TCP header over several packets to make information technology harder for package filters, intrusion detection systems, and other annoyances to detect what you are doing. Be careful with this! Some programs have problem treatment these tiny packets. The old-school sniffer named Sniffit segmentation faulted immediately upon receiving the get-go fragment. Specify this option once, and Nmap splits the packets into eight bytes or less after the IP header. And so a 20-byte TCP header would be split into three packets. Ii with eight bytes of the TCP header, and one with the last four. Of course each fragment as well has an IP header. Specify -f again to use sixteen bytes per fragment (reducing the number of fragments). Or you can specify your own offset size with the --mtu option. Don't also specify -f if you utilise --mtu. The offset must exist a multiple of eight. While fragmented packets won't become by parcel filters and firewalls that queue all IP fragments, such as the CONFIG_IP_ALWAYS_DEFRAG option in the Linux kernel, some networks can't beget the performance hit this causes and thus leave it disabled. Others can't enable this because fragments may take different routes into their networks. Some source systems defragment approachable packets in the kernel. Linux with the iptables connexion tracking module is one such example. Do a scan while a sniffer such equally Wireshark is running to ensure that sent packets are fragmented. If your host Os is causing bug, try the --send-eth choice to featherbed the IP layer and ship raw ethernet frames.

Fragmentation is only supported for Nmap'due south raw packet features, which includes TCP and UDP port scans (except connect scan and FTP bounce scan) and OS detection. Features such as version detection and the Nmap Scripting Engine more often than not don't back up fragmentation because they rely on your host'south TCP stack to communicate with target services.

-D <decoy1> [, <decoy2> ][,ME][,...] (Cloak a scan with decoys)

Causes a decoy scan to be performed, which makes it appear to the remote host that the host(s) you specify as decoys are scanning the target network also. Thus their IDS might report five–ten port scans from unique IP addresses, but they won't know which IP was scanning them and which were innocent decoys. While this tin can be defeated through router path tracing, response-dropping, and other active mechanisms, information technology is mostly an effective technique for hiding your IP address.

Separate each decoy host with commas, and you tin can optionally use ME as one of the decoys to represent the position for your real IP address. If you lot put ME in the 6th position or afterward, some mutual port scan detectors (such as Solar Designer'southward excellent Scanlogd) are unlikely to show your IP address at all. If you don't use ME, Nmap will put you in a random position. Y'all tin can besides utilise RND to generate a random, non-reserved IP accost, or RND: <number> to generate <number> addresses.

Note that the hosts y'all employ equally decoys should be upward or you might accidentally SYN overflowing your targets. Also information technology will exist pretty easy to determine which host is scanning if only ane is really upwards on the network. You might desire to utilise IP addresses instead of names (and so the decoy networks don't see you in their nameserver logs). Right now random IP accost generation is but supported with IPv4

Decoys are used both in the initial host discovery browse (using ICMP, SYN, ACK, or whatever) and during the actual port scanning phase. Decoys are too used during remote OS detection (-O). Decoys exercise not work with version detection or TCP connect scan. When a scan delay is in upshot, the delay is enforced between each batch of spoofed probes, not between each individual probe. Because decoys are sent as a batch all at in one case, they may temporarily violate congestion control limits.

It is worth noting that using likewise many decoys may tedious your browse and potentially fifty-fifty make it less accurate. Likewise, some ISPs will filter out your spoofed packets, but many do not restrict spoofed IP packets at all.

-South <IP_Address> (Spoof source address)

In some circumstances, Nmap may non exist able to make up one's mind your source address (Nmap will tell you if this is the case). In this situation, apply -S with the IP accost of the interface you wish to send packets through.

Some other possible use of this flag is to spoof the browse to make the targets call back that someone else is scanning them. Imagine a company beingness repeatedly port scanned by a competitor! The -e option and -Pn are by and large required for this sort of usage. Annotation that you unremarkably won't receive reply packets dorsum (they will be addressed to the IP yous are spoofing), so Nmap won't produce useful reports.

-e <interface> (Apply specified interface)

Tells Nmap what interface to ship and receive packets on. Nmap should be able to detect this automatically, but it will tell you if it cannot.

--source-port <portnumber> ; -g <portnumber> (Spoof source port number)

One surprisingly common misconfiguration is to trust traffic based simply on the source port number. It is easy to sympathize how this comes about. An ambassador volition ready upward a shiny new firewall, simply to exist flooded with complaints from ungrateful users whose applications stopped working. In particular, DNS may be broken because the UDP DNS replies from external servers can no longer enter the network. FTP is some other common example. In active FTP transfers, the remote server tries to establish a connection dorsum to the client to transfer the requested file.

Secure solutions to these problems exist, oft in the form of application-level proxies or protocol-parsing firewall modules. Unfortunately there are also easier, insecure solutions. Noting that DNS replies come from port 53 and active FTP from port 20, many administrators have fallen into the trap of only allowing incoming traffic from those ports. They frequently assume that no attacker would notice and exploit such firewall holes. In other cases, administrators consider this a short-term cease-gap mensurate until they can implement a more than secure solution. Then they forget the security upgrade.

Overworked network administrators are not the but ones to fall into this trap. Numerous products have shipped with these insecure rules. Even Microsoft has been guilty. The IPsec filters that shipped with Windows 2000 and Windows XP contain an implicit rule that allows all TCP or UDP traffic from port 88 (Kerberos). In another well-known example, versions of the Zone Alarm personal firewall up to 2.1.25 allowed any incoming UDP packets with the source port 53 (DNS) or 67 (DHCP).

Nmap offers the -m and --source-port options (they are equivalent) to exploit these weaknesses. Simply provide a port number and Nmap will send packets from that port where possible. Most scanning operations that apply raw sockets, including SYN and UDP scans, support the option completely. The pick notably doesn't have an issue for any operations that use normal operating system sockets, including DNS requests, TCP connect scan, version detection, and script scanning. Setting the source port also doesn't work for Os detection, because Nmap must use different port numbers for certain Os detection tests to work properly.

--data <hex string> (Append custom binary data to sent packets)

This selection lets y'all include binary information as payload in sent packets. <hex string> may be specified in any of the following formats: 0xAABBCCDDEEFF <...> , AABBCCDDEEFF <...> or \xAA\xBB\xCC\xDD\xEE\xFF <...> . Examples of use are --information 0xdeadbeef and --information \xCA\xFE\x09. Note that if you specify a number like 0x00ff no byte-gild conversion is performed. Make sure you lot specify the information in the byte club expected by the receiver.

--data-string <string> (Append custom string to sent packets)

This pick lets y'all include a regular string equally payload in sent packets. <cord> can contain any string. All the same, note that some characters may depend on your system's locale and the receiver may not see the same data. Also, make sure yous enclose the string in double quotes and escape any special characters from the beat. Examples: --information-string "Scan conducted past Security Ops, extension 7192" or --information-string "Ph34r my l33t skills". Keep in heed that nobody is probable to really see any comments left by this option unless they are carefully monitoring the network with a sniffer or custom IDS rules.

--data-length <number> (Append random data to sent packets)

Ordinarily Nmap sends minimalist packets containing only a header. So its TCP packets are mostly 40 bytes and ICMP echo requests are just 28. Some UDP ports and IP protocols get a custom payload by default. This option tells Nmap to append the given number of random bytes to nearly of the packets information technology sends, and not to utilise any protocol-specific payloads. (Utilize --data-length 0 for no random or protocol-specific payloads. Os detection (-O) packets are not afflicted because accurateness there requires probe consistency, only most pinging and portscan packets support this. It slows things down a fiddling, but can make a scan slightly less conspicuous.

--ip-options <S|R [route]|L [road]|T|U ... > ; --ip-options <hex string> (Send packets with specified ip options)

The IP protocol offers several options which may be placed in packet headers. Unlike the ubiquitous TCP options, IP options are rarely seen due to practicality and security concerns. In fact, many Net routers block the most unsafe options such as source routing. Even so options can still be useful in some cases for determining and manipulating the network road to target machines. For instance, you may be able to use the record road pick to determine a path to a target even when more than traditional traceroute-style approaches neglect. Or if your packets are being dropped by a certain firewall, y'all may be able to specify a unlike route with the strict or loose source routing options.

The well-nigh powerful way to specify IP options is to only pass in values as the argument to --ip-options. Precede each hex number with \x then the two digits. Yous may echo certain characters past following them with an asterisk then the number of times you wish them to repeat. For example, \x01\x07\x04\x00*36\x01 is a hex cord containing 36 NUL bytes.

Nmap as well offers a shortcut mechanism for specifying options. Simply pass the letter R, T, or U to request record-route, record-timestamp, or both options together, respectively. Loose or strict source routing may be specified with an L or S followed by a space and then a space-separated listing of IP addresses.

If y'all wish to encounter the options in packets sent and received, specify --packet-trace. For more information and examples of using IP options with Nmap, see http://seclists.org/nmap-dev/2006/q3/52.

--ttl <value> (Set IP time-to-live field)

Sets the IPv4 fourth dimension-to-live field in sent packets to the given value.

--randomize-hosts (Randomize target host guild)

Tells Nmap to shuffle each group of up to 16384 hosts before it scans them. This can brand the scans less obvious to various network monitoring systems, especially when yous combine it with tiresome timing options. If you want to randomize over larger group sizes, increase PING_GROUP_SZ in nmap.h and recompile. An alternative solution is to generate the target IP list with a list scan (-sL -northward -oN <filename> ), randomize it with a Perl script, so provide the whole list to Nmap with -iL.

--spoof-mac <MAC accost, prefix, or vendor name> (Spoof MAC address)

Asks Nmap to use the given MAC accost for all of the raw ethernet frames it sends. This selection implies --send-eth to ensure that Nmap actually sends ethernet-level packets. The MAC given can take several formats. If it is simply the number 0, Nmap chooses a completely random MAC address for the session. If the given string is an even number of hex digits (with the pairs optionally separated by a colon), Nmap will utilise those as the MAC. If fewer than 12 hex digits are provided, Nmap fills in the residue of the vi bytes with random values. If the statement isn't a nothing or hex string, Nmap looks through nmap-mac-prefixes to find a vendor proper noun containing the given string (it is case insensitive). If a friction match is found, Nmap uses the vendor'due south OUI (three-byte prefix) and fills out the remaining 3 bytes randomly. Valid --spoof-mac statement examples are Apple, 0, 01:02:03:04:05:06, deadbeefcafe, 0020F2, and Cisco. This option merely affects raw packet scans such every bit SYN scan or Bone detection, not connection-oriented features such equally version detection or the Nmap Scripting Engine.

--proxies <Comma-separated list of proxy URLs> (Relay TCP connections through a chain of proxies)

Asks Nmap to establish TCP connections with a final target through supplied chain of ane or more HTTP or SOCKS4 proxies. Proxies tin can help hibernate the true source of a scan or evade certain firewall restrictions, but they can hamper scan performance by increasing latency. Users may need to adjust Nmap timeouts and other scan parameters appropriately. In particular, a lower --max-parallelism may help because some proxies reject to handle as many concurrent connections as Nmap opens by default.

This option takes a list of proxies as argument, expressed as URLs in the format proto://host:port. Use commas to split up node URLs in a chain. No authentication is supported withal. Valid protocols are HTTP and SOCKS4.

Warning: this characteristic is still nether development and has limitations. Information technology is implemented within the nsock library and thus has no upshot on the ping, port scanning and OS discovery phases of a scan. Only NSE and version browse benefit from this option so far—other features may disembalm your truthful address. SSL connections are not yet supported, nor is proxy-side DNS resolution (hostnames are always resolved by Nmap).

--badsum (Send packets with bogus TCP/UDP checksums)

Asks Nmap to use an invalid TCP, UDP or SCTP checksum for packets sent to target hosts. Since virtually all host IP stacks properly drop these packets, any responses received are likely coming from a firewall or IDS that didn't bother to verify the checksum. For more details on this technique, see https://nmap.org/p60-12.html

--adler32 (Employ deprecated Adler32 instead of CRC32C for SCTP checksums)

Asks Nmap to apply the deprecated Adler32 algorithm for calculating the SCTP checksum. If --adler32 is non given, CRC-32C (Castagnoli) is used. RFC 2960 originally defined Adler32 equally checksum algorithm for SCTP; RFC 4960 afterwards redefined the SCTP checksums to use CRC-32C. Current SCTP implementations should be using CRC-32C, but in order to elicit responses from erstwhile, legacy SCTP implementations, it may be preferable to use Adler32.

---

Timing and Performance		Output

burkeagnight.blogspot.com

Source: https://nmap.org/book/man-bypass-firewalls-ids.html

Share this post