WEBVTT - This file was automatically generated by VIMEO

1
00:00:02.300 --> 00:00:05.700
 Hello everyone. Welcome back to the pen testing Essentials course.

2
00:00:05.800 --> 00:00:08.100
 In this video. We're going to be taking a look at how

3
00:00:08.100 --> 00:00:11.300
 to perform firewall detection and evasion with

4
00:00:11.300 --> 00:00:14.500
 nmap. Now, as I mentioned in the previous

5
00:00:14.500 --> 00:00:17.700
 section, we are going to be dealing primarily with

6
00:00:17.700 --> 00:00:20.200
 Windows systems. And one thing that all

7
00:00:20.200 --> 00:00:23.500
 Windows, operating systems were the way talking about Windows Server,

8
00:00:23.500 --> 00:00:27.000
 Windows 2000 and Windows 2008

9
00:00:26.100 --> 00:00:29.600
 to 2016. 2012 08,

10
00:00:29.600 --> 00:00:31.900
 talking about desktop additions or Windows 10.

11
00:00:32.900 --> 00:00:35.500
 27 Windows 8.1, all of them.

12
00:00:35.500 --> 00:00:38.700
 Have one thing in common. And that is they have Windows Firewall

13
00:00:38.700 --> 00:00:41.600
 in place right now. Windows Firewall can

14
00:00:41.900 --> 00:00:44.800
 can be again an issue depending on

15
00:00:44.900 --> 00:00:47.300
 the way it's configured. Now. The first thing we need to

16
00:00:47.300 --> 00:00:51.000
 do as any pen test is, we need to understand if

17
00:00:50.200 --> 00:00:53.500
 we actually have a firewall running and

18
00:00:53.500 --> 00:00:56.600
 if the firewall is active and the easiest

19
00:00:56.600 --> 00:00:59.200
 way we can do that within map is by running or

20
00:00:59.200 --> 00:01:01.800
 by performing an act probe scan. Now.

21
00:01:02.500 --> 00:01:05.600
 Sonic probe scan works, very different day. It

22
00:01:05.600 --> 00:01:08.800
 works very differently and counter-intuitively to

23
00:01:08.800 --> 00:01:11.500
 how the default TCP. 3-way handshake is

24
00:01:11.500 --> 00:01:14.800
 initiated. And, again, how it is completed, in

25
00:01:14.800 --> 00:01:17.400
 terms of the sequence, what we're doing now,

26
00:01:17.400 --> 00:01:20.300
 instead of sending your tea, your simple syn packet to

27
00:01:20.300 --> 00:01:23.400
 your target. We're now going to send a packet with only

28
00:01:23.400 --> 00:01:26.700
 the app probe or the ack flag set and

29
00:01:26.700 --> 00:01:29.400
 doing this will allow us to determine whether the

30
00:01:29.400 --> 00:01:31.900
 target is actually being filtered by

31
00:01:32.600 --> 00:01:35.400
 Firewall or that's being protected by a firewall or

32
00:01:35.400 --> 00:01:38.200
 whether it really is not being protected by a firewall or the

33
00:01:38.200 --> 00:01:41.200
 fire wall isn't active and we can easily run this

34
00:01:41.200 --> 00:01:45.500
 on any Target. And what I'm going to do now is I'll

35
00:01:45.500 --> 00:01:48.900
 open up the Metasploit bo3 virtual machine here. And

36
00:01:48.900 --> 00:01:51.200
 I will, I will just open up

37
00:01:51.200 --> 00:01:55.100
 Windows Firewall here. So it's a Windows Firewall and

38
00:01:54.100 --> 00:01:57.800
 we'll open up the wheel and we will say,

39
00:01:57.100 --> 00:02:00.300
 I want to turn Windows firewall on or off.

40
00:02:00.300 --> 00:02:01.700
 So I'll turn it off, just for a

41
00:02:01.900 --> 00:02:04.300
 Second. I just want to show you something, so

42
00:02:04.300 --> 00:02:07.800
 I will turn it off and I'll open up my Kali virtual

43
00:02:07.800 --> 00:02:10.200
 machine again, and we'll run the app probe scan. So

44
00:02:10.200 --> 00:02:13.300
 we say and map, and we can specify the port's that

45
00:02:13.300 --> 00:02:16.400
 we interested in. But in this case, I'll just leave it to the default. So

46
00:02:16.400 --> 00:02:19.200
 I can say in map and we say s a

47
00:02:19.200 --> 00:02:22.400
 so lowercase s uppercase a and the target

48
00:02:22.400 --> 00:02:22.900
 IP.

49
00:02:25.500 --> 00:02:28.400
 We hit enter. It's going to say we require root privileges. So

50
00:02:28.400 --> 00:02:29.500
 I'm just going to provide them.

51
00:02:30.800 --> 00:02:33.300
 And then we are just going to attend turn again. We'll just

52
00:02:33.300 --> 00:02:36.600
 let this can complete and you can see immediately tells

53
00:02:36.600 --> 00:02:39.500
 us that the host is obsolete, forms.

54
00:02:39.500 --> 00:02:42.100
 Host Discovery we get. We then can see that it

55
00:02:42.100 --> 00:02:45.200
 tells us all 1000 scanned ports on the

56
00:02:45.200 --> 00:02:48.400
 Target or unfiltered. So that means that it's the all

57
00:02:48.400 --> 00:02:51.800
 1000 Bots are not being protected or

58
00:02:51.800 --> 00:02:54.000
 not being filtered by a firewall. All

59
00:02:54.300 --> 00:02:57.400
 right now, that's because we've disabled the firewall, but just

60
00:02:57.400 --> 00:03:00.100
 to prove to you that this can does work. I will

61
00:03:00.600 --> 00:03:03.800
 Divide the firewall. So I'll open up manipulatable three

62
00:03:03.800 --> 00:03:06.800
 year again, and I'll go again. I'll say turn Windows

63
00:03:06.800 --> 00:03:09.600
 Firewall or on or off. I'll turn it on for both

64
00:03:09.600 --> 00:03:12.400
 public and private networks, and I'll just hit OK, here

65
00:03:12.400 --> 00:03:15.500
 and we'll go back into Kelly and I'll

66
00:03:15.500 --> 00:03:19.500
 run that one more time just to show you. So, I'll hit enter and

67
00:03:18.500 --> 00:03:21.400
 we can compare the results. You can see for

68
00:03:21.400 --> 00:03:24.800
 one. The, the actual scan is taking longer. So

69
00:03:24.800 --> 00:03:27.100
 that's an indication that something is changed. So

70
00:03:27.100 --> 00:03:30.400
 again, we'll just let the scan complete here. So there

71
00:03:30.400 --> 00:03:30.600
 we are.

72
00:03:30.600 --> 00:03:33.800
 ER, should take just a few more seconds. Again.

73
00:03:33.800 --> 00:03:36.200
 It's going to take significantly longer than the

74
00:03:36.200 --> 00:03:39.500
 actual, then a scan where you don't have

75
00:03:39.500 --> 00:03:42.100
 a firewall in place. But again, this is one of the

76
00:03:42.100 --> 00:03:45.700
 great things about nmap is the ability to detect. Whether,

77
00:03:45.700 --> 00:03:48.600
 you know, we have a firewall up or or not.

78
00:03:48.900 --> 00:03:51.200
 So you can see in this case. We now get the

79
00:03:51.200 --> 00:03:54.200
 same scan results. The host is up, but instead of telling us

80
00:03:54.200 --> 00:03:57.300
 that the ports are our unfiltered, we can now see

81
00:03:57.300 --> 00:04:00.100
 tells us that all 1000 scan ports on

82
00:04:00.100 --> 00:04:00.500
 the

83
00:04:00.600 --> 00:04:03.200
 Are filtered, which means there is a firewall in

84
00:04:03.200 --> 00:04:06.400
 place and this may hinder your scans. All

85
00:04:06.400 --> 00:04:09.200
 right. So now that we've taken a look at at

86
00:04:09.200 --> 00:04:13.200
 how to detect firewalls with nmap using the app, probe. We

87
00:04:13.200 --> 00:04:16.700
 can now take a look at some common firewall evasion techniques.

88
00:04:16.700 --> 00:04:19.400
 All right, so let's get started with that. So the

89
00:04:19.400 --> 00:04:22.800
 first thing we are going to be taking a look at is the

90
00:04:22.100 --> 00:04:25.300
 is one of the most common techniques that has been used

91
00:04:25.300 --> 00:04:28.900
 for quite a while. And that is the ability to actually fragment

92
00:04:28.900 --> 00:04:30.500
 your packets into smaller.

93
00:04:30.600 --> 00:04:34.000
 Aller 8, byte packets, right? So to

94
00:04:33.100 --> 00:04:36.300
 do this, all we need to do is we need to say if we are running

95
00:04:36.300 --> 00:04:40.300
 a simple scan here. We can say fragment and

96
00:04:40.300 --> 00:04:43.300
 we can use the - lowercase f, that means

97
00:04:43.300 --> 00:04:46.300
 fragment and this will fragment it into eight byte

98
00:04:46.300 --> 00:04:49.600
 packets. And of course, you can analyze this yourself. And

99
00:04:49.600 --> 00:04:52.300
 again, the the whole idea behind reducing the

100
00:04:52.300 --> 00:04:55.400
 size of the packages to fragment a packet. So that

101
00:04:55.600 --> 00:04:58.500
 when it's passing through or firewall, the firewall is not

102
00:04:58.500 --> 00:05:00.500
 able to detect what's actually being

103
00:05:00.600 --> 00:05:03.600
 Sent to the Target because it's all in free. It's

104
00:05:03.600 --> 00:05:06.400
 all in fragments as opposed to a single packet that

105
00:05:06.400 --> 00:05:09.800
 contains information that the firewall might flag as as

106
00:05:09.800 --> 00:05:12.500
 malicious, right? So if we say nmap F,

107
00:05:12.500 --> 00:05:15.400
 and we can then, you know, specify our own types of scans,

108
00:05:15.400 --> 00:05:18.600
 like nmap fsv specify a

109
00:05:18.600 --> 00:05:21.300
 fast scan here and then we can type in

110
00:05:21.300 --> 00:05:24.500
 the Target IP here. So I say hit enter again,

111
00:05:24.600 --> 00:05:27.500
 you can see, it's going to tell me the frogs, can requires root

112
00:05:27.500 --> 00:05:30.300
 privileges. So I'll just hit pseudo and I'll

113
00:05:30.300 --> 00:05:30.500
 just

114
00:05:30.500 --> 00:05:33.800
 Hit enter now one more time. So

115
00:05:33.800 --> 00:05:36.300
 again, we'll just let that run. Now. One of the issues that you'll

116
00:05:36.300 --> 00:05:39.500
 have with with fragmentation is fragmentation, was

117
00:05:39.500 --> 00:05:42.700
 really used on older older

118
00:05:42.700 --> 00:05:45.100
 firewall. So again, it can used or it can be used on

119
00:05:45.100 --> 00:05:48.400
 a few old Legacy Windows systems. It also

120
00:05:48.400 --> 00:05:51.600
 is very effective. I've tested this myself on Windows Server,

121
00:05:51.600 --> 00:05:54.800
 2008 system. So you can use this again for

122
00:05:54.100 --> 00:05:58.000
 for very basic level of evasion. So

123
00:05:57.600 --> 00:06:00.300
 again, we're just going to let this can run and

124
00:06:00.300 --> 00:06:00.400
 then

125
00:06:00.600 --> 00:06:03.300
 Going to take a look at performing a since can

126
00:06:03.300 --> 00:06:06.400
 or a stalled scan as it's known. And then we'll also take talk

127
00:06:06.400 --> 00:06:09.600
 about decoys and specifying your empty you

128
00:06:09.900 --> 00:06:13.500
 as an additional option as well. Alright,

129
00:06:13.500 --> 00:06:16.700
 so as you can see, we get our results back and

130
00:06:16.700 --> 00:06:20.500
 again, we get the exact same results we would have gotten. And

131
00:06:20.500 --> 00:06:23.200
 again, the fragmentation really didn't make much of

132
00:06:23.200 --> 00:06:27.000
 a difference apart from slowing down the scan. Because remember, we're fragmenting

133
00:06:26.200 --> 00:06:29.400
 the packets into smaller pieces, which means

134
00:06:29.600 --> 00:06:30.400
 the requests are.

135
00:06:30.500 --> 00:06:33.300
 Owing to be fragmented. And then they need to be sent to the Target where

136
00:06:33.300 --> 00:06:36.100
 they are reassembled, and then interpreted, and then a

137
00:06:36.100 --> 00:06:39.900
 response is sent back. So again, that is fragmentation in

138
00:06:39.900 --> 00:06:42.500
 a nutshell. It's a very basic technique that's used.

139
00:06:42.700 --> 00:06:45.200
 Now. Let's talk about one of the most important types of

140
00:06:45.200 --> 00:06:48.600
 scans and that is your sin or your stilts can, if

141
00:06:48.600 --> 00:06:52.200
 I just clear up my terminal year, so I'll say man and

142
00:06:52.200 --> 00:06:53.200
 I'll say man and map

143
00:06:57.800 --> 00:07:00.600
 Right, enter. You can see that.

144
00:07:00.800 --> 00:07:03.700
 I'll look for the since Cannon. We're looking for the first option

145
00:07:03.200 --> 00:07:06.700
 that is denoted by a minus S1,

146
00:07:06.700 --> 00:07:09.500
 lowercase, and uppercase s.

147
00:07:09.900 --> 00:07:12.500
 So, the since can is the default and most popular

148
00:07:12.500 --> 00:07:15.700
 scan option for good reasons. It can be performed quickly,

149
00:07:15.700 --> 00:07:19.000
 scanning, thousands of stealth is can scanning thousands

150
00:07:18.100 --> 00:07:21.900
 of device devices, as stealthily

151
00:07:21.900 --> 00:07:23.600
 as possible because it

152
00:07:23.700 --> 00:07:26.200
 Never completes TCP connections. All right. So

153
00:07:26.200 --> 00:07:29.800
 this is the de facto scan that you should be running primarily

154
00:07:29.800 --> 00:07:32.800
 because it scans very quickly because it

155
00:07:32.800 --> 00:07:35.600
 is essentially splitting the TCP 3-way handshake

156
00:07:35.600 --> 00:07:38.700
 in half. And secondly, it's going to be extremely sturdy

157
00:07:38.700 --> 00:07:41.800
 because a firewall is looking for, you

158
00:07:41.800 --> 00:07:44.600
 know, you're it's looking for the complete TCP

159
00:07:44.600 --> 00:07:47.500
 3-way handshake. And if you cut it in half,

160
00:07:47.500 --> 00:07:50.200
 then it's really not going to be able to detect what's going on.

161
00:07:50.200 --> 00:07:53.500
 Exactly, because I'll explain it to you, very basically.

162
00:07:53.800 --> 00:07:56.300
 What's happening is in send instead of

163
00:07:56.300 --> 00:07:59.300
 completing the TCP 3-way handshake, where you send your syn

164
00:07:59.300 --> 00:08:02.500
 packet and then you wait, you wait

165
00:08:02.500 --> 00:08:05.500
 for a response from the target, which could either be a cynic.

166
00:08:05.500 --> 00:08:08.200
 If the device is up and then you respond with

167
00:08:08.200 --> 00:08:11.100
 a knack. What we're doing here is we

168
00:08:11.100 --> 00:08:14.300
 are sending a sin and then we wait for a response and

169
00:08:14.300 --> 00:08:17.100
 then irregardless of the response. We simply send a

170
00:08:17.100 --> 00:08:20.100
 reset packet back to the device and we

171
00:08:20.100 --> 00:08:23.300
 essentially splitting it in half making the scan shorter and

172
00:08:23.300 --> 00:08:23.600
 still

173
00:08:23.700 --> 00:08:26.200
 Thea to run. This can all we need to do is type

174
00:08:26.200 --> 00:08:30.100
 in nmap SS. So again - a

175
00:08:30.100 --> 00:08:33.800
 lowercase and uppercase s and then we specify our ports again.

176
00:08:33.800 --> 00:08:37.800
 I'll just use the 100 most common ports and

177
00:08:37.800 --> 00:08:40.200
 we can then specify our Target or any other

178
00:08:40.200 --> 00:08:43.000
 options that we would like. So for example, I

179
00:08:43.200 --> 00:08:46.500
 can say, I want service version detection, and a bit of

180
00:08:46.600 --> 00:08:50.800
 operating system detection. So, 10.0.0.0 X.

181
00:08:50.300 --> 00:08:53.200
 And we can then hit enter. So, what I'm going to

182
00:08:53.200 --> 00:08:53.600
 do now is

183
00:08:53.800 --> 00:08:56.800
 Just going to demonstrate this to you with Wireshark. Right?

184
00:08:56.800 --> 00:08:59.400
 So why shock is a traffic analyzer and

185
00:08:59.400 --> 00:09:02.400
 inspector allows us to analyze packets being sent and

186
00:09:02.400 --> 00:09:05.500
 received from our Target and I'll just specify more

187
00:09:05.500 --> 00:09:08.400
 ethernet 0 interface here. So I'm just going to start

188
00:09:08.400 --> 00:09:11.500
 the scan and it's going to say, it requires root privileges. So

189
00:09:11.500 --> 00:09:14.800
 I'll provide that with root privileges here. So pseudo,

190
00:09:14.200 --> 00:09:17.400
 we're just going to enter. And if I open up why shock

191
00:09:17.500 --> 00:09:20.100
 and I start the capture, now, you can see, we

192
00:09:20.100 --> 00:09:23.300
 have all of these syn packets being sent to the Target. So,

193
00:09:23.300 --> 00:09:23.600
 again,

194
00:09:23.700 --> 00:09:24.600
 I'll just wait.

195
00:09:25.400 --> 00:09:28.400
 I'll just wait for the actual scan to complete.

196
00:09:28.400 --> 00:09:31.300
 Let's see if that's, that's actually running here. There. We are.

197
00:09:31.600 --> 00:09:34.200
 It's running. And I'll just try and zoom in here.

198
00:09:34.200 --> 00:09:38.000
 Let me just try and zoom into the actual traffic being captured. Are

199
00:09:37.100 --> 00:09:40.200
 we all? So, I can now spread this

200
00:09:40.200 --> 00:09:43.600
 out, and I'll just say, I want my info right

201
00:09:43.600 --> 00:09:46.300
 over here. So you can see, we are sending our syn

202
00:09:46.300 --> 00:09:49.200
 packets right over here since insane. We then

203
00:09:49.200 --> 00:09:52.600
 get a syn, ack back from the target. You can see, the IP

204
00:09:52.600 --> 00:09:54.600
 10.0.0.0 X is the

205
00:09:54.700 --> 00:09:57.100
 The source and the destination is OIP. We

206
00:09:57.100 --> 00:10:00.400
 get a syntax. So that means that these ports are going to be open. So,

207
00:10:00.400 --> 00:10:03.300
 poor both Port 21 and 22 open.

208
00:10:03.300 --> 00:10:06.400
 You can see that specified right over here. We

209
00:10:06.400 --> 00:10:09.900
 can also open this up. You can see the source port and the destination Port

210
00:10:09.900 --> 00:10:12.500
 also listed right over here. Alright, so

211
00:10:12.500 --> 00:10:15.800
 that is how we can actually that

212
00:10:15.800 --> 00:10:18.300
 is essentially how this can works by sending syn

213
00:10:18.300 --> 00:10:21.300
 packets, but I just wanted to demonstrate that to you,

214
00:10:21.300 --> 00:10:24.000
 so that you have an understanding. So I'll just close this year. I

215
00:10:24.300 --> 00:10:24.600
 don't want to

216
00:10:24.800 --> 00:10:28.200
 Save the packets and then we are the scan is complete and

217
00:10:27.200 --> 00:10:30.400
 because we used the stealth can

218
00:10:30.400 --> 00:10:33.300
 for one. You can actually tell how much faster that's can

219
00:10:33.300 --> 00:10:36.300
 was and we get all the results we were looking for.

220
00:10:36.600 --> 00:10:39.700
 So there we. Are we able to get our operating system detection service

221
00:10:39.700 --> 00:10:42.300
 version detection. So on and so forth. All

222
00:10:42.300 --> 00:10:45.500
 right, so that is how to use the since can or the stealth scan

223
00:10:45.500 --> 00:10:48.500
 as it's known. Let's talk about a few other techniques.

224
00:10:48.500 --> 00:10:51.200
 One of the techniques that I want to show to you, which is

225
00:10:51.200 --> 00:10:54.400
 really cool. Is the ability to use the decoy. Now

226
00:10:54.400 --> 00:10:54.600
 a

227
00:10:54.700 --> 00:10:57.600
 Decoy is exactly what it is,

228
00:10:57.600 --> 00:11:00.600
 exactly what it states it is it is essentially using

229
00:11:00.600 --> 00:11:03.500
 an IP address or a decoy IP address

230
00:11:03.800 --> 00:11:06.200
 to perform your scan. So for

231
00:11:06.200 --> 00:11:10.000
 example, if we are on a network that

232
00:11:09.200 --> 00:11:12.200
 we are not supposed to have access to and we have

233
00:11:12.200 --> 00:11:15.700
 a firewall running or an intrusion detection system,

234
00:11:15.700 --> 00:11:18.500
 that is running an actively monitoring the network.

235
00:11:18.500 --> 00:11:21.300
 If we try an initial initiate, a scan on

236
00:11:21.300 --> 00:11:24.500
 a Target that we know we do not have permission to do so.

237
00:11:24.700 --> 00:11:27.900
 That would be flagged as a malicious as malicious

238
00:11:27.900 --> 00:11:30.300
 activity, irregardless of how we

239
00:11:30.300 --> 00:11:33.900
 we actually try and make it as stealthy as possible. So

240
00:11:33.900 --> 00:11:36.400
 what we can do is we can actually use another IP

241
00:11:36.400 --> 00:11:39.700
 or another set of ips as decoys to

242
00:11:39.700 --> 00:11:42.300
 actually trick any intrusion detection system of

243
00:11:42.300 --> 00:11:45.600
 firewall into thinking that the scan is coming from another

244
00:11:45.600 --> 00:11:48.700
 IP address, which is absolutely brilliant. So,

245
00:11:48.600 --> 00:11:51.600
 to do this, we have multiple, we

246
00:11:51.600 --> 00:11:54.200
 have multiple ways. We can do this. We

247
00:11:54.200 --> 00:11:54.600
 can actually,

248
00:11:54.700 --> 00:11:57.200
 Ali again, specifying. It is very simple. So again, if

249
00:11:57.200 --> 00:12:00.200
 I wanted to say and map and we can run any type of scan that we

250
00:12:00.200 --> 00:12:03.600
 want, we can say nmap. We want to run a stealth scan and

251
00:12:03.600 --> 00:12:07.400
 we want to run it on all 100, most

252
00:12:07.400 --> 00:12:10.300
 commonly used ports. If I want to use a decoy, I

253
00:12:10.300 --> 00:12:13.800
 use the - uppercase D option. Now

254
00:12:13.800 --> 00:12:16.200
 when we talk about specifying, a decoy, we can

255
00:12:16.200 --> 00:12:19.200
 specify random decoys and to

256
00:12:19.200 --> 00:12:22.900
 do this, we can say RND. Sorry,

257
00:12:22.900 --> 00:12:24.400
 that is a capital or

258
00:12:24.700 --> 00:12:27.500
 These four random, we then use the colon and

259
00:12:27.500 --> 00:12:30.800
 we specify the amount of random IP addresses that

260
00:12:30.800 --> 00:12:33.300
 we want to use an nmap will generate them

261
00:12:33.300 --> 00:12:36.000
 automatically. This is great, and I'll show you why in a

262
00:12:36.300 --> 00:12:39.700
 second. So, if I say, I want to use only three, random IP addresses

263
00:12:39.700 --> 00:12:42.600
 or decoy, and we specify the target IP.

264
00:12:42.600 --> 00:12:45.300
 Here. I'll open up, why shop? Just to show

265
00:12:45.300 --> 00:12:48.700
 you that three other IPS are using apart. And

266
00:12:48.700 --> 00:12:51.500
 these are not going to be our IP address or our Kali

267
00:12:51.500 --> 00:12:54.500
 Linux IP. So again, I'll open up a new tab here.

268
00:12:54.700 --> 00:12:57.400
 And if I list out the

269
00:12:57.400 --> 00:13:00.900
 IP address of the Kali virtual machine, you can see the IPS

270
00:13:00.900 --> 00:13:03.300
 10.0.0.0 in. So just

271
00:13:03.300 --> 00:13:06.300
 keep that in mind as we run this scan. So again,

272
00:13:06.300 --> 00:13:09.100
 I'll just stop the capture and I'll hit enter. It's going

273
00:13:09.100 --> 00:13:12.400
 to tell me to requires root privileges. I'll provide it with those root

274
00:13:12.400 --> 00:13:15.200
 privileges and we'll just capture a bit

275
00:13:15.200 --> 00:13:18.800
 of traffic here. The scan is complete and will stop the capture. So

276
00:13:18.800 --> 00:13:20.100
 if we go to the top here,

277
00:13:21.200 --> 00:13:24.600
 And we take a look at the sin request being sent. You

278
00:13:24.600 --> 00:13:27.600
 can see that the source IP address is not our

279
00:13:27.600 --> 00:13:30.500
 IP address at all. It's going to be these three IP

280
00:13:30.500 --> 00:13:33.200
 addresses that are going to be used and you can see them

281
00:13:33.200 --> 00:13:36.500
 being repeated frequently. So for example, you can see the

282
00:13:36.500 --> 00:13:39.500
 sequence is repeated after every every

283
00:13:39.500 --> 00:13:42.300
 sin packet has been sent so it sends one with to

284
00:13:42.300 --> 00:13:45.100
 8.1 sixty six point two one seven. It

285
00:13:45.100 --> 00:13:48.300
 then moves on to one ninety. Six point, one 62 and

286
00:13:48.300 --> 00:13:50.500
 then 2008 point to 49 and then it repeats.

287
00:13:50.600 --> 00:13:54.300
 Repeats again. So 28.1 60 61 96.1

288
00:13:53.300 --> 00:13:57.100
 62, 28 .2 49 so

289
00:13:56.100 --> 00:13:59.600
 you can see that. That is really that really

290
00:13:59.600 --> 00:14:02.500
 is brilliant because we can mask our activity as

291
00:14:02.500 --> 00:14:05.600
 other IP addresses, which is great. So if

292
00:14:05.600 --> 00:14:09.200
 you're on a private Network that, again, you

293
00:14:09.200 --> 00:14:12.300
 want to be as clandestine as possible. You can also make it look

294
00:14:12.300 --> 00:14:15.200
 like the scan is coming from a, an

295
00:14:15.200 --> 00:14:18.200
 authorized system on the network. So for example, if you,

296
00:14:18.200 --> 00:14:20.500
 if there is an administrator on the network,

297
00:14:20.700 --> 00:14:23.700
 You can actually spoof their IP address

298
00:14:23.900 --> 00:14:26.600
 to make it look like the scan is coming from their IP

299
00:14:26.600 --> 00:14:29.200
 address, which is brilliant. So again, we can do the

300
00:14:29.200 --> 00:14:32.600
 same thing. We say and Matt and I'll say we want to run a stealth scan.

301
00:14:32.300 --> 00:14:35.400
 We're going to run it on all 100, most

302
00:14:35.400 --> 00:14:39.100
 common ports and we can then specify our decoy.

303
00:14:38.100 --> 00:14:41.300
 And then we specify the IP we want to

304
00:14:41.300 --> 00:14:44.300
 use as our decoy in this case. Let's make this can

305
00:14:44.300 --> 00:14:47.700
 look like it's coming from the actual access point or the Gateway

306
00:14:47.200 --> 00:14:50.200
 or the router IP address. So you can say

307
00:14:50.200 --> 00:14:50.400
 10

308
00:14:50.600 --> 00:14:53.700
 Point zero point zero point one. And then we specify

309
00:14:53.700 --> 00:14:57.900
 the actual IP address of the target 10.0.0.0 6,

310
00:14:57.300 --> 00:15:00.300
 I'll hit enter. And again, it's

311
00:15:00.300 --> 00:15:03.100
 going to ask me for root privileges. I keep forgetting to provide it

312
00:15:03.100 --> 00:15:06.200
 with root privileges. We will start a new capture here.

313
00:15:06.200 --> 00:15:09.300
 So continue without saving and I'm going to hit enter and

314
00:15:09.300 --> 00:15:12.200
 we let that go. We let that continue scanning and then we

315
00:15:12.200 --> 00:15:15.300
 are the scan is complete and you can see right over here. It keeps sending its

316
00:15:15.300 --> 00:15:19.700
 in packets with the source IP of 10.0.0.0 one.

317
00:15:19.100 --> 00:15:20.500
 And again,

318
00:15:20.600 --> 00:15:23.100
 And it's really is brilliant. That the fact that you can

319
00:15:23.100 --> 00:15:26.300
 actually mask your IP address or use a decoy. I

320
00:15:26.300 --> 00:15:29.900
 IP address to make it look like the scan is coming from

321
00:15:29.900 --> 00:15:32.400
 another device on the network or another

322
00:15:32.400 --> 00:15:35.200
 device that is on the Internet or that is not part of

323
00:15:35.200 --> 00:15:38.400
 the network. Really, really is brilliant. So these are

324
00:15:38.400 --> 00:15:41.400
 the tactics primarily that I wanted to show you

325
00:15:41.400 --> 00:15:44.900
 in regards to in regards to firewall detection

326
00:15:44.900 --> 00:15:47.100
 and evasion. So that's pretty much going to

327
00:15:47.100 --> 00:15:50.300
 be all that. I wanted to cover in this video and I'll be seeing

328
00:15:50.300 --> 00:15:50.400
 you.

329
00:15:50.500 --> 00:15:51.600
 You in the next video?