In the case of a connection let's UDP protocol which we do not expect to respond scanning is marginally
more complicated because this is a connection less protocol that doesn't respond a connection attempt
to close the port will fail and will be presented with an error message in such a case you can exploit
the fact that as the RNC documents States the computer should respond with an ICMP port unreachable
message.
Scanning itself has one basic flaw.
It sends back the information about the scanner.
It may seem that you can't connect to the target host while remaining unnoticed.
However there are ways to remain anonymous.
One of them is using multiple fake IP addresses to hide the attackers identity.
But we won't cover this here
another method is called the idle scan it exploits the fact that in accordance with RSU standards a
computer that receives an unexpected TCAP session packet should respond with r s t.
The only exception is when it receives an R S T packet which should be ignored.
Otherwise the internet would be crammed with millions of R-S.C. packets being sent back and forth in
an infinite loop.
We can take advantage of this fact and use any computer that is connected to the World Wide Web.
Even if we don't have physical access to it to scan another computer this is the idea behind the idle
scan.
Please look at the diagram in the slide this shows the mechanism of the attack we find a computer that
will make an appropriate zombie machine we send a packet to it.
We record the IP ID and identification field used for identifying fragments of an original IP datagram
we only need to remember the number some implementations of operating system still in use today generate
an IP ID number in an incremental and predictable way every further packet will have a higher IP ID
number knowing that we can send the scanning packet to the target machine.
When we use the address of the zombie instead of our own the target computer will send the response
to the zombie in case the port is open.
Otherwise the response will not be sent at all.
The zombie will react correspondingly to the packet it receives.
It will either send or not send the Aristid to the target.
Then we probe for an IP ID again and we compare it to the number we got before.
If the number has increased by 1 It means that the zombie has sent the arist packet.
We learned that the port on the target machine was open without directly connecting to it.
In a moment we will try to make a demonstration.