Let us talk about different options we can use in our scans to bypass firewall firewall is something
unpredictable.
You don't really know its rules in order to know exactly what type of scan you need to perform in order
to bypass it.
Some of the firewalls could use Mac address filtering in order to allow certain devices to connect to
a specific port or in order to block certain devices.
Some firewalls could block different types of packets.
Some firewalls could block only some ports and not all of them.
And we can't really know what the exact rule is.
What I'm going to do is I will give you a few different options as to what you can try in order to bypass
firewall.
First of all, how can we know if some of the ports and target machine are behind a firewall?
We already mentioned this in the previous video and map will tell us that those ports are filtered by
now.
We should already know what filtered port is, but let us define it once again.
Filtered port is when EMAP can't figure out whether a certain port is open or closed, and that is due
to dropping packets, possibly because that port is behind the firewall.
Therefore, we don't get any responses back from that port and and up it as filtered.
Let me show you this on a Windows machine right here, I have Windows seven virtual machine and this
virtual machine, if I go to the control panel and then system and security and Windows firewall, this
machine has firewall turned on.
If we tried to scan it using scan, which we covered in the previous section.
So let's do it right here.
Remember, it requires studio privileges.
So certain aspects.
And then the IP address, I believe, is the IP address of my Windows seven virtual machine.
And if I press here, enter typing the password in just a few seconds, this can will finish and we're
going to compare this result when the firewall is turned on with the result once we turn off the firewall.
So let's wait for this to end.
And here it is, it doesn't have any port open, matter of fact, it will tell me all one thousands
can ports on this PC are filtered.
Now, this doesn't mean that all could be closed or all could be opened, this just means that they
are behind the firewall and any package we send get dropped by that firewall.
So our target could have a few ports open and other closed, but we don't really know that.
Let me show you the response of the same scan once we have that target turn off their firewall.
So let's go to Windows Machine and I will click on this turn Windows firewall on or off.
And in both of these things, I will select turn off Windows Firewall, click on OK.
And now once the firewall is turned off, let us perform the same scan that we did right here, so we'll
just use upper error from the same command.
And here it is.
We can see that some ports are indeed open this far wall right here doesn't have any special rules since
it is made to block all traffic.
So this news that I'm about to show you in these few videos will not work on the regular machines that
just turn on their firewall and they don't accept any type of connection.
However, once firewall rules are applied and they usually are applied in some servers or machines that
need remote access or that need to communicate with other machines, then we can test these options
and see whether those rules have any vulnerability that we can bypass.
I will turn the firewall back on right here.
I will close this and let's start with our first option.
We're going to use an option F, so if I clear the screen and type the comments to the map F and then
the IP address, this dash F option causes the requested scan to use pinay fragmented IP packets.
Now, you might be wondering why would we do that?
Well, the idea behind this is to split Tippi Hedren over several packets to make it harder for package
filters or intrusion detection systems to detect what you're doing.
If we specify the option once, just by adding one dash, if the map will split the packets into eight
bytes or less.
So if your packet had a twenty four bytes DCP header.
This would be split into three different packets of eight bytes.
Now, you can also specify the option twice with F and then once again that chef and this will split
the packets into 16 bytes per fragment.
But be careful once running this option on an actual target is some programs have trouble handling these
tiny packets.
If you want to increase fragment size even more, you can use the option dash, dash M2.
And after it defragment size, just remember that offset you specify must be a multiple of eight.
This fragmentation won't always work if I run, this can this option will not work most of the time,
actually it only works if a network that you're scanning can afford the hip that this will cause.
Therefore, they just leave it disabled.
Some networks also can enable this because fragments may take different routes into their networks.
Nonetheless, it is good to mention this option as it might come in handy one day.
Another option we can use, which is more focused on hiding your IP address, then bypassing security.
And that option is creating decoys, using Desh to see if a specified dash and then capitally.
Creating these decoys can make it appear to the target as it has been scanned not only by you, but
also by the decoys that you specify.
So their intrusion detection system might report multiple IP addresses that scan them, including yours,
but they will not be able to determine which one is real.
So you successfully hit your IP address from them.
There are two ways that we can do this.
And just to show you how this works, what I'm going to do is I will open a software called Wireshark
on my Windows and machine.
And with this software, we will be able to see which IP addresses are communicating with my Windows
10 machine.
Now, you don't need to have Wireshark for now, just pay attention to the scans that we perform and
the results that we get in Wireshark right here, I will select Ethernet, since that is what I'm currently
using and we should already see some packets coming in.
But these packets right here have nothing to do with our scan.
So if we go back to my clinics and I run the command and map Dashty and to specify how many random IP
addresses we want to use to scan the target, we can specify Dashty and then R and D two dots and then
the number of IP addresses we want to use.
So in this case, I will use five random IP addresses if I press event right here and go to my Warshak.
Hmm, it doesn't seem to be flooding anything.
Are we successfully scanning?
Oh, that's right, we are scanning Windows seven machine, my bed, so we need to be scanning our Windows
10 machines.
So let me check the I.P. address of my Windows 10 IP config when I did that 168, that font at seven.
And right here I will just change from one six to one seven.
Now, let's go back to Wireshark once again.
Hmm, it doesn't seem to show for some reason, let us try adding this comment and people to use the
since can to perform this press enter.
And the reason this might not work is because sometimes foreshock would have a problem capturing the
packets that we send from a virtual machine.
And that is mostly because we're scanning our host machine from the virtual machine.
So what I'm going to do is I'm going to go to my laptop and run the same command gave me just a second
and I'm running the same command that we ran right here.
I just ran it.
And if I go back here, here, we can see now the output.
We can see that our Windows 10 machine is getting flooded with random IP addresses.
If I stop it, I can see different IP addresses right here.
So we got one ninety three to forty five at two hundred and thirteen point seventy seven.
We also got the other IP addresses, but I will also see my laptop's IP address and it kind of sticks
out since this R&D option that we used creates phantom IP addresses, all of those random IP addresses
will be truly random, while the only IP address that will stick out will be this one.
I do that 168, that one to ten and that is a local IP.
So this will most likely not work.
They will recognize it as the IP.
So how can we change this and make it seem like this is coming from five local IP addresses that belong
to my home network, instead of running the command like this, what we can do is we can run the command
like this pseudo map and then Dashty.
And after 30, we specify five different IP addresses, including ours, several specif.
I wanted to do that, one that wanted to.
Let's also use 182 that 168 dot one, dot five, for example.
Let's use one to do that 168 dot fondled six.
Let's use one night to that fancy state, that one, that 15.
And let's at the end use my IP address and to specify the IP address, we can simply type me.
What this command will do is it will use these random IP addresses to scan the target, including our
IP address.
So all we need to specify is the IP address of my Windows machine.
And if I run this, go back to Wireshark.
Yeah, of course.
Once again, I must run this from the actual laptop in order for this to work.
So what I'm going to do is I'm going to run the same command in just a second and I'm running it right
now.
If I go to my Wireshark here, we can see now it is getting flooded with local IP addresses.
We can see when I do that 168 at one to two.
That one, that five dot one, that fifteen and dot one the ten.
And they will never really realize that this one is the correct IP address since they are getting flooded
with a lot of them.
And you can change this number, you can use more IP addresses if you want or less.
But the point of this is that in case you're scanning a target that is inside the same network as you
use local IP addresses, and in case you're scanning the target, it is outside your network.
You can use this option right here, which will generate phantom IP addresses and the security will
have a hard time figuring out which one is the correct one call right now, don't worry, since this
didn't work on my Windows 10 machine, the only reason it didn't work is because Michael Linux machine
uses the same network interface as my Windows 10 host machine.
If you were to scan any other target except your host machine, this would work in every case.
So for now, we looked at these two options and in the next video, I will just quickly mention a few
more options used to evade security and then we will proceed to vulnerability analysis, which is the
last step before we start gaining access to our target.