Hello everyone in this video. We are
going to see how you can fake the TTL values
of your scan.
So what is TTL TTL stands for time to
live? It is the round trip train, which are
request takes to reach to the Target server and
come back with the response. So
The syntax of doing this particular scan is nmap. Target
IP address followed by the
TTL value by hyphen hyphen TTL 128. Remember
to some of the operating system. The
TTL values are fixed. For example,
the TTL value of Linux operating system
as 64. Where is the TTL
value of a Windows operating system is one
28
so we can identify in case if we
are.
Sending any particular request to any Target and
the TTL that we receive we can identify if
the target server is running onto
a Linux operating system or a
Windows operating system.
so
In this scan. We are going to spoof our
TTL value and we will
not let the target server identify that the
request is coming from a Windows computer or
a Linux computer.
So you can also.
Use any custom TTL value that you want to
confuse the target machine as well.
You can add hyphen V to see the output inverse
mode the example of doing this particular scan
is being written over here.
So this is the Practical time and let's see how
you can run this particular scan. Well.
I am onto a Linux machine. So the TTL value
of my Linux machine would be 64.
So, let me just ping this particular IP.
And when I ping this you can see the TTL value which
is the time to live is 64, which means this
particular machine to which I
have paint is a Linux machine.
alright
now
you can see over here. I'm going to run this
particular command wherein I'm going to give the TTL
as 1:28.
so
you can see the output I have scanned the machine already. I'm
going to run a
Wireshark filter, which is IP dot
TTL
This particular filter is used to filter the request
based on the TTL values.
So you can see I have given a TTL value of 128, which
means generally the request should be
coming from a Windows based operating system.
Let's verify.
Over here you can see that this particular
machine has scanned itself and
the value is 1 28.
As you can see over here, the machine was Linux
machine, but instead of showing a
TTL of 64. It is
showing a TTL of 128 which
symbolizes the TTL value
of a Windows operating system. So this is
the way we have spoofed our TTL to bypass some
of the machines which basically restrict the
scanners based on the TTL values
Let us go on to this website wherein you
can read about default device TTL
values and over here. You can easily
see that 128 TTL
value is for Windows based computers
mostly.
As you can see over here.
128 represent and symbolizes Windows
computers
what we have scanned from a Linux computer and still we
choose this TTL value that was 128
instead of 64.
So
I hope you guys understood how we can fake our
TTL value while we are scanning any particular
Target using in map.
Thank you.