-: Let us talk about different options we can use
in our scans to bypass firewall.
Firewall is something unpredictable.
You don't really know its rules
in order to know exactly what type
of scan you need to perform in order to bypass it.
Some of the firewalls could use MAC address filtering
in order to allow certain devices to connect
to a specific port or in order to block a certain devices.
Some firewalls could block different types of packets.
Some firewalls could block only some ports and not all
of them, and we can't really know what the exact rule is.
What I'm going to do is I will give you
a few different options as
to what you can try in order to bypass firewall.
First of all, how can we know if some
of the ports on target machine are behind a firewall?
We already mentioned this in the previous video
and Nmap will tell us that those ports are filtered.
By now we should already know what filtered port is
but let us define it once again.
Filtered port is when Nmap can't figure out
whether a certain port is open or closed
and that is due to dropping packets
possibly because that port is behind a firewall.
Therefore, we don't get any responses back
from that port and Nmap flags it as filtered.
Let me show you this on a Windows machine.
Right here I have Windows seven virtual machine
and this virtual machine, if I go to the control panel
and then system and security and Windows Firewall
this machine has firewall turned on.
If we tried to scan it using SYN scan, which we covered
in the previous section, so let's do it right here.
Remember, it requires sudo privileges
so pseudo nmap dash SS and then the IP address.
I will use the IP address
of my window seven virtual machine
and if I press here enter type in the password,
in just a few seconds, this scan will finish
and we're going to compare this result when
the firewall is turned on
with the result once we turn off the firewall.
So let's wait for this to end.
And here it is.
It doesn't have any port open.
Matter of fact, it will tell me all 1000 scanned ports
on this PC are filtered.
Now this doesn't mean
that all could be closed or all could be opened.
This just means that they're behind the firewall
and any packets we send get dropped by that firewall.
So our target could have a few ports open and other closed
but we don't really know that.
Let me show you the response of the same scan,
once we have that target turn off their firewall.
So let's go to Windows machine
and I will click on this turn Windows firewall on or off.
And in both of these settings I will select
turn off Windows Firewall firewall.
Click on OK, and now once the firewall is turned off
let us perform the same scan that we did right here.
So we'll just use upper arrow
run the same command, and here it is.
We can see that some ports are indeed open.
This firewall right here doesn't have any special rules
since it is made to block all traffics.
So techniques that I'm about to show you
in these few videos will not work
on regular machines that just turn on their firewall
and that don't accept any type of connection.
However, once firewall rules are applied
and they usually are applied in some servers
or machines that need remote access
or that needs to communicate with other machines
then we can test these options and see whether
those rules have animal vulnerability that we can bypass.
I will turn the firewall back on right here.
I will close this and let's start with our first option.
We're going to use an option dash F.
So if I clear the screen
and type the command sudo nmap dash F and then
the IP address
this dash F option causes the requested scan
to use tiny fragmented IP packets.
Now you might be wondering why would we do that?
Well, the idea behind this is to split TCP header
over several packets to make it harder for packet filters
or intrusion detection systems to detect what you're doing.
If we specify the option once just by adding one dash F
the nmap will split the packets into eight bytes or less.
So if your packet had up 24 bytes TCP header
this would be split
into three different packets of eight bytes.
Now you can also specify the option twice with dash F
and then once again dash F
and this will split the packets into 16 bytes per fragment.
But be careful once running this option on an actual target
as some programs have trouble handling these tiny packets.
If you want to increase fragment size even more
you can use the option
dash dash mtu and after it the fragment size,
just remember that offset you
specify must be on multiple of eight.
This fragmentation won't always work if I run this scan.
This option will not work most of the time actually.
It only works if a network that you're scanning
can afford the hit that this will cause, therefore
they just leave it disabled.
Some networks also cant enable this because fragments
may take different routes into their networks.
Nonetheless, it is good to mention this option
as it might come in handy one day.
Another option we can use, which is more focused
on hiding your IP address than bypassing security
and that option is creating decoys using dash D.
So if I specify dash and then capital D
creating this decoys can makes it appear
to the target as it has been scanned
not only by you but also by the decoys that you specify.
So their intrusion detection system might report
multiple IP addresses that scan them, including yours
but they will not be able to determine
which one is real so you successfully hid your
IP address from them.
There are two ways that we can do this, and just
to show you how this works, what I'm going to do is
I will open a software called WireShark
on my Windows 10 machine.
And with this software
we will be able to see which IP addresses are communicating
with my Windows 10 machine.
Now you don't need to have WireShark for now
just pay attention to the scans that we perform
and results that we get in WireShark.
Right here I will select ethernet since that is
what I'm currently using
and we should already see some packets coming in
but these packets right here have nothing to do
with our scan.
So if I go back to my Kal Linux and I run the command
sudo nmap dash D and to specify how many random IP
addresses we want to use to scan the target
we can specify dash D and then RND:
and then the number of IP addresses we want to use.
So in this case, I will use five random IP addresses.
If I press enter right here and go to my WireShark.
Hmm, it doesn't seem to be flooding anything.
Are we successfully scanning?
Oh, that's right.
We are scanning Windows seven machine.
My bad.
So we need to be scanning our Windows 10 machine.
So let me check the IP address
on my Windows 10. IP config, 192.168.1.7
and right here I will just change from 1.6 to 1.7.
Now let's go back to WireShark once again.
Hmm, it doesn't seem to show for some reason.
Let us try adding this command
and we will use the SYN scan to perform this.
Press enter.
And the reason this might not work is
because sometimes WireShark will have a problem
capturing the packets that we send from a virtual machine
and that is mostly because we are scanning our host machine
from the virtual machine.
So what I'm going to do is I'm going to go
to my laptop and run the same command.
Give me just a second
and running the same command that we ran right here.
I just ran it.
And if I go back here, here we can see now the output.
We can see that our Windows 10 machine is getting flooded
with random IP addresses.
If I stop it, I can see different IP addresses right here.
So we got 193.245.213.77.
We also got the other IP addresses
but I will also see my laptops IP address
and it kind of sticks out.
Since this RND option that we used creates
random IP addresses.
All of those random IP addresses will be truly random
while the only IP address that will stick out
will be this 192.168.1.10
and that is a local IP.
So this will most likely not work.
They will recognize it as the true IP.
So how can we change this
and make it seem like the scan is coming
from five local IP addresses that belong to my home network?
Instead of running the command like this,
what we can do is we can run the document like this,
sudo nmap and then dash D, and after dash D
we specify five different IP addresses, including ours.
So we'll specify 192.168.1.2.
Let's also use 192.168.1.5 for example.
Let's use 192.168.1.6.
Let's use 192.168.1.15.
And let's at the end use my IP address
and to specify the Kal Linux IP address,
we can simply type, ME.
What this command will do is it will use these random
IP addresses to scan the target,
including our true IP address.
So all we need to specify is the IP address
of my Windows 10 machine.
And if I run this, go back to WireShark, yeah of course
once again I must run this
from the actual laptop in order for this to work.
So what I'm going to do is I'm going to run the same command
in just a second and I'm running it right now.
If I go to my WireShark here we can see
now it is getting flooded with local IP addresses.
We can see 192.168.1.2.
.1.5, .1.15,
and .1.10 and they will never really realize
that this one is the correct IP address
since they're getting flooded with a lot of them.
And you can change this number
you can use more IP addresses if you want or less.
But the point of this is that
in case you're scanning a target that is
inside the same network as you use local IP addresses
and in case you're scanning the target that is
outside your network, you can use this option right here
which will generate random IP addresses
and the security will have hard time figuring out
which one is the correct one.
Cool right? Now don't worry
since this didn't work on my Windows 10 machine.
The only reason it didn't work is
because my Kal Linux machine uses the same network interface
as my Windows 10 host machine.
If you were to scan any other target
except your host machine, this would work in every case.
So for now, we looked at these two options
and in the next video I will just quickly
mention a few more options used to evade security
and then we will proceed to vulnerability analysis
which is the last step
before we start gaining access to our target.