Nmap Firewall - IDS Evasion and Spoofing Part 2
Continuing with firewall and IDS, evasion and spoofing.
Pop over to this tab here where the minus minus proxies option, which you can see here, you can establish a scan with a final target through a supply chain of one or more http or Sox for proxies using a comma to separate out the proxies.
So you can see here, we've got the proxies option.
Then we've got the proxy server.
It's poor, another proxy server, and it's poor in the chain.
And then the target for the scan, these proxies can help hide the true source of a scan or can evade certain firewall restrictions.
If going through these proxies will help you out, but they can hamper scam performance by increasing the latency.
You may need to adjust the Nmap timeouts and other scam parameters accordingly in particular, ALO max parallelism may help because some proxies refuse to handle.
As many concurrent connections as Nmap opens by default, the bottom line is that proxy, the proxies option is not really a feature I would ever recommend unless you absolutely had to use it.
It will slow or fail to perform correctly.
And the proxies don't provide great anonymization.
Anyway, a black hat hacker, for example, would scan from a hacked device.
To hide the IP address of devices.
He wanted to remain anonymous instead of using some sort of limited options such as this proxies option.
And we do discuss further on the course more about how black hats use Nmap.
So check out that if that interests.
We got -- data - length.
There's depends random data's the send packets packaged, generated by Nmap scans.
Usually just have the protocol.
Head is set and only in certain cases include specific payloads Nmap implements this feature to slightly decrease the likelihood of detecting these known probes by using random data as payloads OS detection, the minus O packets.
Or not affected because of the need for accuracy.
There requires pro consistency, but most pinging and port scan packets support.
This is slows things down.
Let's all, but can make a scan slightly less conspicuous.
So for example, we can see here, we've added 200 to the end there.
We've done the scan. Nice and quick.
Let's pop over to another tab.
The - - data, this option lets you include a regular string as payload in send packet.
- - data - string.
This option lets you include a regular string as payload in the send packet.
So you can see in this example here, this might be useful if you want the systems, administrators of the systems that you're scanning, knowing what's going on and what it is that you're doing, they can see in the logs that it was you or someone else who's got appropriate permission.
And some of the final options here.
So we've got IP dash options.
This sends packets with specified IP options.
As it says, with this option, you can change flags in the IP header.
IP options are rarely seen due to practicality and security concerns.
In fact, many internet routers block, the most dangerous options such as source routing.
So not often use. -TTL, this sets the IPV for time to live field in sent packets to the given value that you specify.
You have dash dash spoof Mac, which spoofs the Mac address.
This option only affects raw packet scans, such as SYN scan or OS detection, not connection, orientated feature.
Such as version detection or Nmap scripting engine.
So I don't actually recommend using this for spoofing your Mac.
You want to use something else instead if you're on windows, check out T-Mac.
If you're on Linux and you can use the Mac changer that comes with Kali, if you're on Mac, you can use Mac, daddy X, and there's also Wi-Fi spoof.
So check those out as alternatives to this option here.
And the reason I don't recommend to use it is because it doesn't support all features.
Whereas if, for example, Kali used Mac changer, it will support all features so best not to use this and use an alternative Mac spoofer instead.
And then we have bad song, which has, it says this sends packets where they bogus TCP UDP, or S C T P check.
If you're worried about IDS detection, you don't want to be detected.
You want to be a little less conspicuous than here's an example of a command that you can run.
You can add a little tiny fragmenting to the IP packet.
You can slow the scan down.
I've got it on zero here.
You can add some decoys you can.
You can, you can append some random data to the sent packets and you can spoof your Mac and I'm would be spoofing it using not the Nmap version.
And there you have a relatively stealthy version of an Nmap.