Nmap Firewall - IDS Evasion and Spoofing Part 1
Here we are in Nmap, help as usual, beginning of the lecture.
So this lecture we'll cover Nmap firewall and intrusion detection, system evasion and spoofing.
Let's pop over onto the first tab here.
This caused the requests as scan, including ping scans to use tiny fragmented IP package.
The idea is to split up the TCP header over several packets to make it harder for packet filters, intrusion detection systems, IDS, and others to detect what it is you're doing.
So that's where the -F option we pop over to this tab here.
You can also set up your own size to, with a -M T U option.
So here we are at specified to 16, so let's run the scan, see what we get.
And there we go.
We can see the standard results just to let you know, also with -F and -M T U I've had inconsistent results.
So sometimes they've reported incorrectly the number of ports that are available, but normally it produces a results just fine.
Next let's look at cloaking, a scan with decoys.
Decoys scan option, which can cause confusion as to where the scan came from with this decoy option, all packets originate from your scanning machine, but some have spoofed source addresses, sourced, IP addresses, any replies to the spoofed source.
IP addresses. Well, not arrive at your scanner.
So they cannot be used to determine port states, etc.
This technique serves to confuse port scan detection and IDS, and does not offer any information beyond a regular scan.
And it's also noisy too.
So the -D option, which you can see here is the decoy option, which appears to the target that the host.
You specify as decoys are scanning the target network to those, their IDS would report multiple port scans from unique IP addresses, but they won't know which IP address was scanning them and which were innocent decoys.
So if we look at this command here, we have the -D for the decoy option.
Then we have this here, which is our first decoy, a random IP address.
Our second decoy, another random IP address and a third decoy.
And then the fourth one here.
And this can be as many as you like.
And the fourth one here.
This is the actual IP address for this server here, that so we can get the results back.
And then finally we have the actual target there at the end.
So we have 3 decoys IP addresses the real IP address, and then the target IP address.
If I run that scan now against 192.168.1.1, then we can quickly see the results.
In rare circumstances, Nmap may not be able to determine your source IP address.
Nmap will tell you if this is the case. And in this situation you use the -S option with the IP address of the interface that you wish to send packets.
Another possible use for this fly is to spoof the scan, to make the targets thing that someone else is scanning them.
The spoofed address will then get the blame for the scan.
So here we're scanning Facebook as if we're coming from Microsoft.
So let's run the scan here. And what we're being told here is if -S as being used to fake your source address, you may also have to use -E and then the interface and -P N.
So if we pop over to here, we can see I've added the interface that I want to use, and then I've added the non-Discovery there as well.
So if I click that, and of course we won't see any results because it's sending the data back to Microsoft and not back to us.
With the -G option or also --source - port, which does the same thing.
You're able to specify the source port by adding the port number after the -G.
So you can see we've got port 53 specified most scanning operations that use raw sockets, including SYN, UDP scans support this option completely.
The option notably doesn't have an effect for any operations that use normal operating systems sockets, including DNS requests, TCP connects scans version detection, script scanning, setting the source port also doesn't work for OS detection because Nmap must use different port numbers for certain OS detection tests to work.
So why might be, want to use a different source port well, it can help you bypass network filters and firewalls.
It can fall some IDs and even systems administrators too often.
The source ports are trusted or identified based solely on that number.
So common ports that get over trusted are things like DNS on port 53 on TCP and UDP.
FTP on port 20 on TCP Kerberos on port 88, TCP and UDP port 67 DHCP on UDP.
This can be trusted based solely on their source port.
So if you run this scan here, so what could happen here?
In this example, a system administrator looking at his logs might just assume that the scan was DNS request to the wrong server.
And not in fact, in the Nmap scan.