We mentioned fragmented packets and creating decoys in the previous video.
Right now we're going to mention a few more options.
And even though they are not that important, it is good to know they exist.
So let's go through them real fast.
I will not be running these options, but you can test them out if you want.
I will just mention them so you know what else you can use.
The first thing we got is option Eshe.
S.
And you run it like this pseudo Anne-Mette Dash s and this option is used to spoof your IP address,
it will make your target think that someone else is scanning them.
The problem with this is that you will not get results of a scan back since they will be sent to the
IP address that you're trying to impersonate.
So, for example, you can be trying to impersonate eight, eight eight and your target will be scanned
with this IP address, or at least it will seem that the scan is coming from this IP address.
For this option to work.
You must also specify Deshpande.
And the reason why you might specify Deshpande is first of all, the is used to assume that all hosts
are online.
She doesn't perform the ping scan to discover whether a host is up and running without the dashboard.
This option would not work, and the reason is because your target will be scanned with this IP address.
And we will not be able to get the packets back and see whether the target is on or off.
That's why we will just assume that the target is online so we can scan them with a different IP address.
Otherwise, we will never get the result, whether they are online.
And sometimes with these two options, you must also run that she is used to specify a network interface.
So you would simply just type I have config check out what network interface you are using and you would
specify it right here.
In my case, that would be ETJ zero.
Another cool option besides this that my is you can specify the source port with dash g option.
This can sometimes help bypass the firewall, for example, a network administrator may set up a firewall
and set the rule where all the traffic from a certain port is allowed.
And with that, he's probably thinking that attackers won't be able to figure out from which port exactly.
And if you perform a scan and send packets from the port that's allowed in the firewall rule, you successfully
bypassed firewall.
So it specified for Dashty.
And then random phone number.
And one less thing that we will mention that could help you in bypassing firewall is changing different
skin types.
We already covered some skin types and any of them could be useful to you sometimes.
For example, in case you perform a scan on a target machine and in case the skin is blocked by the
target's fireball, which would mean that they drop all scene requests that try to initiate this connection.
We could try to perform our thin skin and thin skin is labeled like this, that S.F..
Now, you're probably confused because there are a lot of scans that we can do.
And in case you don't have any networking background, you're probably wondering what scan even means.
Well, thin scan is just sending a fin packet without any other flags.
And this flags and flags can be confusing sometimes, but with practice you will catch everything up.
Just one advice I have is that every time you don't fully understand something, just Google it.
That is how I learned as well.
And all of these options that we covered can be combined with something called timing template.
And to show you what timing template really is, I opened up my and my manual right here and I scrolled
to this option right here, which says Dashty timing template.
And if you also open up and map manual, this will be all the way down.
So there are about one or two minutes of scrolling until you reach this option.
Here in the manual, we can see the Dashty comes with six different options or six different modes.
And what's interesting for us regarding security vision are the first towboats which are zero and one
also called paranoid and sneaky.
These two are used for ideas, evasion, as it says right here.
Now, the problem with T zero and T one or the first two options is since they are trying to avoid IDRs
alerts, they will take a lot longer to finish.
So once you're scanning more machines or more networks, this might not be the most reasonable approach
to take, since this scan will take a lot of time with specifying dash zero or dash one.
And all of this, including the options that we covered in the last video, will help you in security,
evasion and spoofing.
What I would advise you to do is also read about other options as well that we didn't cover just to
see what else can you do in the next video?
Big things are happening.
We're going to create our first tool used for penetration testing.
Let's do it.