Hello, everyone.
In this video we are going to see various techniques
to bypass the
firewall and ideas using nmap.
So what is a firewall and IDs?
IDs stands for intrusion detection system
which is one of the preventive measures software
which is installed onto any server which
detects if there is any malicious or
harmful attack or a pattern which
is not a regular pattern if happening.
in case there is a attack or someone is
trying to scan the ports or
any particular set of ips then IDs
and firewall May tend to block those
particular users based on some rules.
They may block the IP address as well as the MAC address.
But in this video we are going to see how you can bypass both
firewall and IDs on to end
any web server.
So the first scan that we are going to see is unmap
Cloak scan with decoys. This
is one of the amazing scan that I
really like.
Wherein you can spoof your IP address
and trick the victim to think if
the scan is coming from somewhere else.
The syntax is very simple. You just have to type nmap
Target IP.
Followed by hyphen D which is which is the
decoy IP that you want to show the victim from where
the request is coming from. So decoys can
will make you Anonymous and use some other IP
address to SCAN the target Network in the practical.
For example, we are going to use Google's IP
address to SCAN the victim.
The victim will think that the request is
coming from Google server, but instead we will
be scanning the target.
Generally, the IP address of these types of search engines
are not blocked in any of the firewall or
servers and we can utilize this type of
cloak scan with decoys to
bypass the firewalls and ideas.
So it is the Practical time and let's see
how you can use this particular decoy scan
to bypass the firewall.
So as you can see here.
First we are going to write a IP tables
firewall rule.
In which we are going to write that for any request
log the prefix that is attacker and
map this means basically if we
get any particular request a TCP
request on to our Target server,
then there should be a log created
in the syslog file
with a prefix called as attacker and
map very simple. We are just doing this to
see the logs.
Okay.
So let me just type this over here
and we have created a firewall rule which will
show for any TCP request the locks
with a prefix attacker and map.
This is the command that we are going to use.
Remember, this is our Target IP address and
this is the IP address that we are going to
use to scan the target. This IP address
is Google servers IP address.
So I will keep this ready over here. And this
is the path where you can see the locks
into a Linux machine, which is what log
syslog. I'm going to use the tail
command to see the logs of that particular
file.
I will just copy this into a new terminal and
I'm going to grab.
This particular IP. So I will just grab this which
means if any request comes to
this particular Target server into the system log
with this particular specific IP. I
will filter that IP from the all the system
logs request.
so
we are going to run this and you can see I have
run this particular scan.
Let's see over here. So I did not
hit enter. Now. I'm going to hit enter to grep
this particular IP from the system
log files. So I'm going to run this can again.
I will run this and you can see in the logs. We
are able to successfully see. Okay, we are
able to see that.
attacker and map IP
1 particular request came
with a source address. What is the source address?
The source address is the Google IPS address,
which we used as a decoy. What is
the destination address destination address is the
server's own IP address, which we are scanning. What is
the protocol the protocol is TCP as you can
see over here.
All right, so we are able to
Perform a scan staying Anonymous by
telling the particular server that
the request is being generated from Google's
servers IP this
way. You can scan any particular Target staying
Anonymous and without even revealing your
IP address.
I hope you guys understood how you can perform this particular scan.
By using any decoy IP that
you want in this case. I have used Google's IP.
You can also use any other IP into
your same network to trick the victim in thinking
that another person is scanning that
particular victim from your network.
I hope you guys understood this. Thank you.