‫Idle scan is an advanced scan method that allows for a truly blind TCP port scan of the target truly
‫blind TCP port scan means no packets are sent to the target from your real IP address.
‫Instead, a unique side channel attack exploits predictable IP fragmentation ID sequence generation
‫on the zombie host to gather information about the open ports on the target.
‫Idea systems will display the scan as coming from the zombie machine, you specify.
‫The idle scan is based on the following three facts, as you already know.
‫One way to determine whether TCP Port is open is to send a signed packet to the port.
‫The target machine will respond with a snack packet.
‫If the port is open and rest, if the port is closed.
‫A machine that receives an unexpected sinek packet will respond with a receipt.
‫An unexpected receipt will be ignored.
‫Every IP packet on the internet has a fragment identification number, IP ID since many operating systems
‫simply increment this number for each packet they send.
‫Probing for the iPad can tell an attacker how many packets have been sent since the last probe.
‫So first, let's see what happens in an idle scan at the target board is open.
‫The first step is to probe the IPID of the zombie system.
‫The attacker sends a cynic to the zombie.
‫Since his army does not expect the packet, it sends back a receipt with an iPad.
‫The second step is to forge a send packet from the zombie to the target system.
‫The target sends a sinek in response to the sin that appears to come from the zombie.
‫Since his army does not expect the packet, it sends back a receipt and so it increments its Ipid in
‫the process.
‫Third step is to probe the zombie's iPad again.
‫The attacker sends a sinek the zombie again.
‫The rest packet of the zombie has an iPad, which is increased by two since the first step, so the
‫port is open.
‫Now let's see what happens in an idle scan of the target board is closed.
‫The first step is to probe the IPD of the zombie system.
‫The attacker sends a sinek to the zombie since the zombie does not expect the packet, it sends back
‫a receipt with an iPad.
‫The second step is to forge a sin packet from the zombie to the target system.
‫The target sends a receipt because the port is closed in response to the sin that appears to come from
‫the zombie.
‫The zombie ignores the unexpected risk, so it's IPID does not change.
‫Third step is to probe the zombies IPID again.
‫The attacker sends a sinek to the zombie again.
‫The risk packet of the zombie has an IPID, which is increased by only one since the first step.
‫So the board is not open.
‫You follow.
‫So then here's the last one.
‫Let's see what happens in an idle scan if the target board is filtered.
‫The first step is to probe the IPID of the zombie system.
‫The attacker sends a sinek to the zombie since a zombie does not expect the packet, it sends back a
‫wrist with an iPad.
‫The second step is to forge a signed packet from the zombie to the target system.
‫The target filtering its port ignores the sin that appears to come from the zombie.
‫The zombie is unaware that anything happened, so its iPad remains the same.
‫Third step is to probe the zombies rapid again, the attacker sends a sinek to the zombie again.
‫The risk packet of the zombie as an iPad, which is increased by only one since the first step, so
‫the port is not open.
‫So from the attacker's point of view, the filtered port is indistinguishable from a closed port.
‫You see why, in both cases, the iPad is increased by only one.
‫So let's have an idle scan.
‫To be able to perform an idol scan, we first need to have a zombie computer on the network, which
‫has incremental Ipid's sequencing.
‫Hopefully, we have an end map script to help us find a computer appropriate to become a zombie.
‫I know the name of the script starts with IPD and put a star.
‫Now here's the script Ipid's Que and AC.
‫To use this grip, tape and map script, iPads, CQ.
‫And now our IP block one seven two eight one six nine nine zero 24.
‫They keep it simple, let's scan just the top two port.
‫And here are the results, so let's analyze them.
‫Ninety nine point one is my whole system, it's a Mac, and as you see, iPad is randomized, nineteen
‫point two is the gateway of my virtual LAN.
‫And yes, it has incremental ID sequencing.
‫It can be used as a zombie system.
‫Good I.
‫Nine nine, two one three nine is a Linux system.
‫It's Ipid sequence is all in zero nine nine two zero six is our target Metasploit of all.
‫Nine, nine, two, two two is our colleague machine.
‫It's Ipid's sequence is incremental, so it's actually another zombie candidate, but it's already the
‫attack itself so that it makes sense to use it as a zombie.
‫But I understand you.
‫Yes, it might be fun.
‫All right, now, we're going to use nine, nine two as a zombie.
‫So here's the end map idol scan query as upper case I do Idol Scan now put the IP address of the zombie.
‫I want to use my host machine first, which has a randomized Ipid's sequence.
‫Not necessarily, but I think it's a good habit, P, N and N Target Systems IP.
‫So as you see and Map says, the Zombies Ipid's sequence class is randomized, so we should find another
‫system.
‫So what do you think about using a zombie system with an all zeros Ipid's sequence class?
‫Hmm.
‫As you see, again, it's just not suitable to be a zombie.
‫Now, is it time to use this system, which has an incremental Ipid's sequence class?
‫So again, to keep it quick and simple, I'll just scan the top three put.
‫And yes, scan is completed successfully to compare the results.
‫I'd like to have a sign scan in another terminal screen with the same conditions for its 23 and 80 are
‫open in both scans.
‫According to Since Scan, Port 443 is closed now, we know that the idle scan cannot distinguish the
‫closed board from the filtered port.
‫It flagged Port 443 as closed or filtered, so let's run the last query with reason.
‫Option again.
‫As you see, ports 23 and 80 are flagged as open because IPID has changed each time.
‫Since the iPad has not changed, report four, four three, its flag disclosed or filtered.