So in these Nmap lectures, we have seen no port scan also known as ping scan, different ways of scanning
ports, SYN scan, also known as halfopen scanning, TCP scan, also known as TCP connect scan, UDP scan,
Service and Version detection, Operating System detection and Nmap Scripting Engine in detail.
Now let's see how we can cope with network security devices such as firewalls or packet filtering.
You with me, you will always face some security measures in your penetration test.
They will got you,
drop your packets or reply some fake responses so you have to find those measures and bypass them and
to go on. Network obstructions such as firewalls can make mapping a network exceedingly difficult.
It will not get any easier as stifling casual reconnaissance is often a key goal of implementing the
devices. Nevertheless Nmap offers many features to help understand these complex networks and verify
that the filters are working as intended.
It even supports mechanisms for bypassing poorly implemented defenses.
One of the best methods of understanding your network security posture is to try to defeat it.
In addition to restricting network activity companies are increasingly monitoring traffic with intrusion
detection systems or IDS. All of the major IDSs
ship with rules designed to detect and Nmap scans. Because scans are sometimes a precursor to attacks.
Many of these products have recently morphed into intrusion prevention systems, IPSs, that actively block
traffic deemed malicious.
Unfortunately for network administrators and IDS vendors, reliably detecting bad intentions by analyzing
packet data is a tough problem. Attackers with patience, skill and the help of certain Nmap options
can usually pass by IDSs undetected.
Meanwhile administrators must cope with large numbers of false positive results where innocent activities
misdiagnosed and alerted on or blocked so there's no magic bullet for detecting and bypassing firewalls and IDS
systems.
It takes skill and experience.
So here I'm going to show you a few methods to bypass or detect the IDS and IPS devices.
Although timing techniques are used to improve scan times, they're also very good at being invisible
against a network security devices such as firewalls or IDS s and IPSs.
We'll see the timing techniques in detail.
But let's see the other techniques to bypass security measures. The -f option causes the requested scan
to use tiny fragmented IP packets.
The idea here is to split up the TCP header over several packets to make it harder for packet filters,
intrusion detection systems and other annoyances to detect what you are doing.
Specify this option once and Nmap splits the packets into 8 bytes or less
after the IP header.
So a 20 byte TCP header would be split into three packets.
So be careful with this some programs have trouble handling these tiny packets. Fragmentation is only
supported for Nmaps raw packet features which include TCP and UDP port scans and OS detection features
such as version detection and the unmap scripting engine generally don't support fragmentation because
they rely on your hosts TCP stack to communicate with target services.
Using well-known ports as a source port to the packets that will send is another technique to bypass
firewalls. To trust traffic based only on the source port number is one surprisingly common misconfiguration.
It's easy to understand how this comes about,
an administrator will set up a shiny new firewall only to be flooded with complaints from ungrateful
users whose applications stopped working. In particular DNS may be broken because the UDP DNS replies
from external servers can no longer enter the network.
Here Nmap offers the source port option to exploit this weakness. Simply provide a port number and
Nmap will send packets from that port where possible. --randomise-hosts tells Nmap to shuffle
each group of hosts before it scans them.
This can make the scans less obvious to various network monitoring systems, especially when you combine
it with slow timing option.
You can use the -S to spoof the scan to make the targets think that someone else is scanning
them.
Note that you won't usually receive reply packets back.
They will be addressed to the IP
you are spoofing. So nMap won't produce useful reports.
You can also use some techniques to understand the existence of the security measures.
The first technique is to analyze the TTL the time to live values of the incoming packets.
The TTL values of the packets coming from the destination systems may differ from the TTL values of
the packets coming from a network security device. So find incoming packets which result two different
results and analyze their TTL values.
--badsum option asks Nmap to use an invalid TCP or UDP checksum for packets sent to target hosts.
Since virtually all host IP stacks properly drop these packets any responses received are likely coming
from a firewall or IDS
that didn't bother to verify the checksum