Hello everyone. Welcome back to the pen testing Essentials course.
In this video. We're going to be taking a look at how
to perform firewall detection and evasion with
nmap. Now, as I mentioned in the previous
section, we are going to be dealing primarily with
Windows systems. And one thing that all
Windows, operating systems were the way talking about Windows Server,
Windows 2000 and Windows 2008
to 2016. 2012 08,
talking about desktop additions or Windows 10.
27 Windows 8.1, all of them.
Have one thing in common. And that is they have Windows Firewall
in place right now. Windows Firewall can
can be again an issue depending on
the way it's configured. Now. The first thing we need to
do as any pen test is, we need to understand if
we actually have a firewall running and
if the firewall is active and the easiest
way we can do that within map is by running or
by performing an act probe scan. Now.
Sonic probe scan works, very different day. It
works very differently and counter-intuitively to
how the default TCP. 3-way handshake is
initiated. And, again, how it is completed, in
terms of the sequence, what we're doing now,
instead of sending your tea, your simple syn packet to
your target. We're now going to send a packet with only
the app probe or the ack flag set and
doing this will allow us to determine whether the
target is actually being filtered by
Firewall or that's being protected by a firewall or
whether it really is not being protected by a firewall or the
fire wall isn't active and we can easily run this
on any Target. And what I'm going to do now is I'll
open up the Metasploit bo3 virtual machine here. And
I will, I will just open up
Windows Firewall here. So it's a Windows Firewall and
we'll open up the wheel and we will say,
I want to turn Windows firewall on or off.
So I'll turn it off, just for a
Second. I just want to show you something, so
I will turn it off and I'll open up my Kali virtual
machine again, and we'll run the app probe scan. So
we say and map, and we can specify the port's that
we interested in. But in this case, I'll just leave it to the default. So
I can say in map and we say s a
so lowercase s uppercase a and the target
IP.
We hit enter. It's going to say we require root privileges. So
I'm just going to provide them.
And then we are just going to attend turn again. We'll just
let this can complete and you can see immediately tells
us that the host is obsolete, forms.
Host Discovery we get. We then can see that it
tells us all 1000 scanned ports on the
Target or unfiltered. So that means that it's the all
1000 Bots are not being protected or
not being filtered by a firewall. All
right now, that's because we've disabled the firewall, but just
to prove to you that this can does work. I will
Divide the firewall. So I'll open up manipulatable three
year again, and I'll go again. I'll say turn Windows
Firewall or on or off. I'll turn it on for both
public and private networks, and I'll just hit OK, here
and we'll go back into Kelly and I'll
run that one more time just to show you. So, I'll hit enter and
we can compare the results. You can see for
one. The, the actual scan is taking longer. So
that's an indication that something is changed. So
again, we'll just let the scan complete here. So there
we are.
ER, should take just a few more seconds. Again.
It's going to take significantly longer than the
actual, then a scan where you don't have
a firewall in place. But again, this is one of the
great things about nmap is the ability to detect. Whether,
you know, we have a firewall up or or not.
So you can see in this case. We now get the
same scan results. The host is up, but instead of telling us
that the ports are our unfiltered, we can now see
tells us that all 1000 scan ports on
the
Are filtered, which means there is a firewall in
place and this may hinder your scans. All
right. So now that we've taken a look at at
how to detect firewalls with nmap using the app, probe. We
can now take a look at some common firewall evasion techniques.
All right, so let's get started with that. So the
first thing we are going to be taking a look at is the
is one of the most common techniques that has been used
for quite a while. And that is the ability to actually fragment
your packets into smaller.
Aller 8, byte packets, right? So to
do this, all we need to do is we need to say if we are running
a simple scan here. We can say fragment and
we can use the - lowercase f, that means
fragment and this will fragment it into eight byte
packets. And of course, you can analyze this yourself. And
again, the the whole idea behind reducing the
size of the packages to fragment a packet. So that
when it's passing through or firewall, the firewall is not
able to detect what's actually being
Sent to the Target because it's all in free. It's
all in fragments as opposed to a single packet that
contains information that the firewall might flag as as
malicious, right? So if we say nmap F,
and we can then, you know, specify our own types of scans,
like nmap fsv specify a
fast scan here and then we can type in
the Target IP here. So I say hit enter again,
you can see, it's going to tell me the frogs, can requires root
privileges. So I'll just hit pseudo and I'll
just
Hit enter now one more time. So
again, we'll just let that run. Now. One of the issues that you'll
have with with fragmentation is fragmentation, was
really used on older older
firewall. So again, it can used or it can be used on
a few old Legacy Windows systems. It also
is very effective. I've tested this myself on Windows Server,
2008 system. So you can use this again for
for very basic level of evasion. So
again, we're just going to let this can run and
then
Going to take a look at performing a since can
or a stalled scan as it's known. And then we'll also take talk
about decoys and specifying your empty you
as an additional option as well. Alright,
so as you can see, we get our results back and
again, we get the exact same results we would have gotten. And
again, the fragmentation really didn't make much of
a difference apart from slowing down the scan. Because remember, we're fragmenting
the packets into smaller pieces, which means
the requests are.
Owing to be fragmented. And then they need to be sent to the Target where
they are reassembled, and then interpreted, and then a
response is sent back. So again, that is fragmentation in
a nutshell. It's a very basic technique that's used.
Now. Let's talk about one of the most important types of
scans and that is your sin or your stilts can, if
I just clear up my terminal year, so I'll say man and
I'll say man and map
Right, enter. You can see that.
I'll look for the since Cannon. We're looking for the first option
that is denoted by a minus S1,
lowercase, and uppercase s.
So, the since can is the default and most popular
scan option for good reasons. It can be performed quickly,
scanning, thousands of stealth is can scanning thousands
of device devices, as stealthily
as possible because it
Never completes TCP connections. All right. So
this is the de facto scan that you should be running primarily
because it scans very quickly because it
is essentially splitting the TCP 3-way handshake
in half. And secondly, it's going to be extremely sturdy
because a firewall is looking for, you
know, you're it's looking for the complete TCP
3-way handshake. And if you cut it in half,
then it's really not going to be able to detect what's going on.
Exactly, because I'll explain it to you, very basically.
What's happening is in send instead of
completing the TCP 3-way handshake, where you send your syn
packet and then you wait, you wait
for a response from the target, which could either be a cynic.
If the device is up and then you respond with
a knack. What we're doing here is we
are sending a sin and then we wait for a response and
then irregardless of the response. We simply send a
reset packet back to the device and we
essentially splitting it in half making the scan shorter and
still
Thea to run. This can all we need to do is type
in nmap SS. So again - a
lowercase and uppercase s and then we specify our ports again.
I'll just use the 100 most common ports and
we can then specify our Target or any other
options that we would like. So for example, I
can say, I want service version detection, and a bit of
operating system detection. So, 10.0.0.0 X.
And we can then hit enter. So, what I'm going to
do now is
Just going to demonstrate this to you with Wireshark. Right?
So why shock is a traffic analyzer and
inspector allows us to analyze packets being sent and
received from our Target and I'll just specify more
ethernet 0 interface here. So I'm just going to start
the scan and it's going to say, it requires root privileges. So
I'll provide that with root privileges here. So pseudo,
we're just going to enter. And if I open up why shock
and I start the capture, now, you can see, we
have all of these syn packets being sent to the Target. So,
again,
I'll just wait.
I'll just wait for the actual scan to complete.
Let's see if that's, that's actually running here. There. We are.
It's running. And I'll just try and zoom in here.
Let me just try and zoom into the actual traffic being captured. Are
we all? So, I can now spread this
out, and I'll just say, I want my info right
over here. So you can see, we are sending our syn
packets right over here since insane. We then
get a syn, ack back from the target. You can see, the IP
10.0.0.0 X is the
The source and the destination is OIP. We
get a syntax. So that means that these ports are going to be open. So,
poor both Port 21 and 22 open.
You can see that specified right over here. We
can also open this up. You can see the source port and the destination Port
also listed right over here. Alright, so
that is how we can actually that
is essentially how this can works by sending syn
packets, but I just wanted to demonstrate that to you,
so that you have an understanding. So I'll just close this year. I
don't want to
Save the packets and then we are the scan is complete and
because we used the stealth can
for one. You can actually tell how much faster that's can
was and we get all the results we were looking for.
So there we. Are we able to get our operating system detection service
version detection. So on and so forth. All
right, so that is how to use the since can or the stealth scan
as it's known. Let's talk about a few other techniques.
One of the techniques that I want to show to you, which is
really cool. Is the ability to use the decoy. Now
a
Decoy is exactly what it is,
exactly what it states it is it is essentially using
an IP address or a decoy IP address
to perform your scan. So for
example, if we are on a network that
we are not supposed to have access to and we have
a firewall running or an intrusion detection system,
that is running an actively monitoring the network.
If we try an initial initiate, a scan on
a Target that we know we do not have permission to do so.
That would be flagged as a malicious as malicious
activity, irregardless of how we
we actually try and make it as stealthy as possible. So
what we can do is we can actually use another IP
or another set of ips as decoys to
actually trick any intrusion detection system of
firewall into thinking that the scan is coming from another
IP address, which is absolutely brilliant. So,
to do this, we have multiple, we
have multiple ways. We can do this. We
can actually,
Ali again, specifying. It is very simple. So again, if
I wanted to say and map and we can run any type of scan that we
want, we can say nmap. We want to run a stealth scan and
we want to run it on all 100, most
commonly used ports. If I want to use a decoy, I
use the - uppercase D option. Now
when we talk about specifying, a decoy, we can
specify random decoys and to
do this, we can say RND. Sorry,
that is a capital or
These four random, we then use the colon and
we specify the amount of random IP addresses that
we want to use an nmap will generate them
automatically. This is great, and I'll show you why in a
second. So, if I say, I want to use only three, random IP addresses
or decoy, and we specify the target IP.
Here. I'll open up, why shop? Just to show
you that three other IPS are using apart. And
these are not going to be our IP address or our Kali
Linux IP. So again, I'll open up a new tab here.
And if I list out the
IP address of the Kali virtual machine, you can see the IPS
10.0.0.0 in. So just
keep that in mind as we run this scan. So again,
I'll just stop the capture and I'll hit enter. It's going
to tell me to requires root privileges. I'll provide it with those root
privileges and we'll just capture a bit
of traffic here. The scan is complete and will stop the capture. So
if we go to the top here,
And we take a look at the sin request being sent. You
can see that the source IP address is not our
IP address at all. It's going to be these three IP
addresses that are going to be used and you can see them
being repeated frequently. So for example, you can see the
sequence is repeated after every every
sin packet has been sent so it sends one with to
8.1 sixty six point two one seven. It
then moves on to one ninety. Six point, one 62 and
then 2008 point to 49 and then it repeats.
Repeats again. So 28.1 60 61 96.1
62, 28 .2 49 so
you can see that. That is really that really
is brilliant because we can mask our activity as
other IP addresses, which is great. So if
you're on a private Network that, again, you
want to be as clandestine as possible. You can also make it look
like the scan is coming from a, an
authorized system on the network. So for example, if you,
if there is an administrator on the network,
You can actually spoof their IP address
to make it look like the scan is coming from their IP
address, which is brilliant. So again, we can do the
same thing. We say and Matt and I'll say we want to run a stealth scan.
We're going to run it on all 100, most
common ports and we can then specify our decoy.
And then we specify the IP we want to
use as our decoy in this case. Let's make this can
look like it's coming from the actual access point or the Gateway
or the router IP address. So you can say
10
Point zero point zero point one. And then we specify
the actual IP address of the target 10.0.0.0 6,
I'll hit enter. And again, it's
going to ask me for root privileges. I keep forgetting to provide it
with root privileges. We will start a new capture here.
So continue without saving and I'm going to hit enter and
we let that go. We let that continue scanning and then we
are the scan is complete and you can see right over here. It keeps sending its
in packets with the source IP of 10.0.0.0 one.
And again,
And it's really is brilliant. That the fact that you can
actually mask your IP address or use a decoy. I
IP address to make it look like the scan is coming from
another device on the network or another
device that is on the Internet or that is not part of
the network. Really, really is brilliant. So these are
the tactics primarily that I wanted to show you
in regards to in regards to firewall detection
and evasion. So that's pretty much going to
be all that. I wanted to cover in this video and I'll be seeing
you.
You in the next video?