Hello everyone. So in this video we
are going to see the idle or zombie scan
of nmap.
The syntax of doing this scan is nmap hyphen
SI the zombie IP address
- P the port number and the target IP
address that you want to scan.
In this can we need a zombie in order to
perform this type of scan?
In a nutshell and map will attempt to leverage and
idle host into your network to indirectly
launch a port scan.
therefore hiding our original IP address from
the target
It is one of the more controversial options in nmap, since
it really only has.
One use that is for malicious attacks.
So what happens in this type of scan as you
can see on the left hand side is the unmarked machine
through which we are going to scan.
On the right hand side is the server and in
the middle is the zombie which we are going
to use to scan this server and give the
results to us.
So first the nmap is going to send
a send request to the zombie and the zombie is
going to connect to the Target server.
now
the zombie is going to receive a response from
the server and the zombie is going to send back the same
response to the and map machine.
So, let's see the Wireshark packet break down over
here. We can identify that the IP
192 16843.244 is sending
a send request to this IP address.
It is again send it to send request and it
has received a reset act reset act and
then it sends.
a synac to this IP address
So what are the advantages and disadvantages of
this type of scan?
The advantage is it is useful to hide your
identity and scan host.
The disadvantage is it is typically harder to
perform these days as firewall detects and blocks them.
So it is the Practical time and let's understand this
better in Practical scenario.
I have typed the command which is nmap hyphen SI which
stands for zombie or idle scan and this is the
zombie that I'm going to use in my network, which is idle.
This is my phone's IP address, which is connected to my network. So
I'm going to scan these four ports of
this target machine.
And I will add hyphen V to see the output in verbose mode.
As you can see the idle scan using zombie. This
IP address has been successfully initiated.
This is the target machine which
we are running the scan on and this is a zombie which is
being used.
As you can see in the wire shock the packet that
I've been sent from our machine.
That is the nmap machine 213 to 244
are these packets?
Over here you can see 244 is
sending a request to the Target machine. That is 97.
As you can see over here.
As you can see 244 is sending Target requests
to this particular IP address and it is
also sending reset in response.
So this is how a zombie scan
Works where we are
going to use a zombie to scan a particular
Target and the target is going to reply to
a zombie and zombie is going to send the data back
to us and we will identify that. What is
the correct status?
I hope you guys understood.
Nowadays this type of scan is easily detected
and blocked. So we are not going to use very very
effectively. It is very rare.
Thank you.