Idle scan as an advance scan method that allows for a truly blind TCP port scan of the target. Truly blind
TCP port scan means no packets are sent to the target from your real IP address.
Instead, a unique side channel attack exploits predictable IP fragmentation ID sequence generation on
the zombie host to gather information about the open ports on the target. IDS systems will display the
scan as coming from the zombie machine
you specify. The idle scan is based on the following three facts. As you already know.
One way to determine whether TCP port is open is to send a SYN packet to the port. The target machine
will respond with a SYN/ACK.
If the port is open and RST if the port is closed. A machine that receives an unexpected SYN/ACK packet
will respond with a RST and unexpected RST will be ignored.
Every IP packet on the Internet has a fragment identification number IP ID. Since many operating systems
simply increment this number for each packet they send. Probing for the IP ID can tell an attacker how
many packets have been sent since the last probe.
So first let's see what happens in an idle scan if the target board is open.
The first step is to probe the IP ID of the zombie system. The attacker sends a SYN/ACK to the zombie.
Since the zombie does not expect the packet, it sends back a RST with an IP ID.
The second step is to forge a SYN packet from the zombie to the target system.
The target sends a SYN/ACK in response to SYN and that appears to come from the zombie. Since the zombie
does not expect the packet, it sends back a RST.
And so it increments its IP ID and the process. Third step is to probe the zombie's IP ID again. The attacker
sends a SYN/ACK
to zombie again the RST packet of the Zombie has an IP ID which is increased by two since the first
step.
So the port is open.
Now lets see what happens in an idle scan if the target board is closed.
The first step is to probe the IP ID of the zombie system.
The attacker sends a SYN/ACK to the zombie. Since the zombie does not expect the packet it sends back
a RST with an IP ID.
The second step is to forge a SYN packet from the zombie to the target system. The target sends a
RST because the port is closed in response to SYN and that appears to come from the Zombie. The zombie
ignores the unexpected risks.
So its IP ID does not change.
Third step is to probe the zombie's IP ID again.
The attacker sends a SYN/ACK to the zombie again.
The RST packet of the Zombie has an IP ID which is increased by only 1 since the first step.
So the board is not open, you follow.
So then, here's the last one.
Let's see what happens in an idle scan if the target port is filtered.
The first step is to probe IP ID of the zombie system. The attacker sends a SYN/ACK to the zombie. Since
the zombie does not expect the packet it sends back a RST with an IP ID.
The second step is to forge a SYN packet from the zombie to the target system.
The target filtering its port, ignores this SYN that appears to come from the zombie.
The zombie is unaware that anything happened so its IP ID remains the same. Third step is to probe the
zombies IP ID again.
The attacker sends a SYN/ACK to the zombie again.
The RST packet of the zombie has an IP ID which has increased by only 1 since the first step.
So the port is not open.
So from the attackers point of view the filtered port is indistinguishable from a closed port.
You see why, in both cases the IP ID is increased by only one.
So lets have an idle scan. To be able to perform an idle scan,
we first need to have a zombie computer on the network which has incremental IP ID sequencing. Hopefully,
we have an unmap script to help us find the computer appropriate to become a zombie.
I know the name of the script starts with “ipid”, and put a star now.
Here is the script, ipidseq.nse
To use the script, type “nmap -­script ipidseq” and now our IP block, 172.16.99.0/24
To keep it simple, let’s scan just the top 2 ports
and here are the results.
So let's analyze them
99.1
is my host system.
It’s a Mac
and as you see, IP ID is randomised
99.2 is the gateway of my virtual LAN
and yes, it has incremental ID sequencing!
It can be used as the zombie system.
99.139 is a Linux system,
its IP ID sequence is all zero. 99.206 is our target, Metasploitable. 99.222 is our Kali machine.
It's IP IDs sequence is incremental.
So it's actually another zombie candidate but it's already the attacker itself. So it doesn’t make sense
to use it as zombie :)
But I understand yes it might be fun.
Right Now, we’re going to use 99.2 as the zombie
So here's the unmap idle scan query. -sI do idle scan. Now put the IP address of the zombie.
I want to use my host machine first which has a randomized IP ID sequence.
Not necessarily but I think it's a good habit. -Pn and n target systems IP.
So as you see Nmap says the zombie's IP ID sequence class is randomized.
So we should find another system.
So we think about using a zombie system with an all zeros IP ID sequence class.
As you see again it's just not suitable to be a zombie.
Now is it time to use this system which has an incremental IP ID sequence class.
So again to keep it simple I'll just scan the top three and yes scan is completed successfully. To compare
the results
I'd like to have a SYN scan in another terminal screen with the same conditions. Ports 23 and 80 are open
on both scans. According to SYN scan
Port 443 is closed.
Now we know that the Idle scan cannot distinguish the closed port from the filtered port.
It flagged port 443 as closed or filtered.
So let's run the last query with -reason option again
as you see ports 23 and 80 are flagged as open because ip ID has changed.
Each time since the IP ID has not changed report 443 its flag disclosed or filtered.