1 00:00:00,850 --> 00:00:04,960 Bypass a bypass and ideas systems within about. 2 00:00:06,480 --> 00:00:08,500 So what is IOPS and ideas? 3 00:00:09,760 --> 00:00:14,970 With the development of network system, security problems have arisen exponentially. 4 00:00:16,270 --> 00:00:22,710 The network system can attack the computers, unauthorized persons may attempt to access computers, 5 00:00:23,380 --> 00:00:28,810 the outgoing packages over the network can be viewed by third parties and saved and viewed on their 6 00:00:28,810 --> 00:00:29,800 own computer. 7 00:00:31,140 --> 00:00:37,340 Critical systems running over the network can then be rendered inoperable and face many security problems. 8 00:00:38,540 --> 00:00:40,310 That's why they called vulnerabilities. 9 00:00:41,480 --> 00:00:48,050 So in order to prevent these security problems, systems that constantly monitor the network and prevent 10 00:00:48,320 --> 00:00:50,690 future attacks are deployed. 11 00:00:51,810 --> 00:01:01,410 So these such systems are called IPS or intrusion prevention systems and ideas or intrusion detection 12 00:01:01,410 --> 00:01:02,070 systems. 13 00:01:03,470 --> 00:01:08,090 So today, there are many very advanced ideas and ideas systems. 14 00:01:09,230 --> 00:01:15,290 With the development of the Internet and these computer systems, many types of attacks can be conducted 15 00:01:15,440 --> 00:01:16,390 over a network. 16 00:01:17,270 --> 00:01:23,240 Therefore, IP and ideas systems are used in just about every network system. 17 00:01:24,740 --> 00:01:27,790 Oh, OK, so how can we scan that within map? 18 00:01:29,090 --> 00:01:33,550 How can I scan without getting caught within an IP and I.D. system? 19 00:01:34,810 --> 00:01:35,770 I'm glad you asked. 20 00:01:36,120 --> 00:01:37,360 It's time to learn about that. 21 00:01:39,210 --> 00:01:42,330 How do bypass, bypass and I.D. systems? 22 00:01:43,720 --> 00:01:49,480 Now, there are actually many ways to circumvent IPS and idea systems when scanning within Matt. 23 00:01:51,220 --> 00:01:52,690 And I'll list some of them. 24 00:01:54,040 --> 00:01:59,590 Timing, the most basic detection method of GPS and idea systems. 25 00:02:01,490 --> 00:02:08,720 Blocked if one rope on the network attempts to access multiple ropes and scans on all ports. 26 00:02:09,770 --> 00:02:14,000 So in this case, all you need to do is scan individual threads and ports. 27 00:02:15,940 --> 00:02:20,530 And then don't access more than one IP and one bought at the same time. 28 00:02:20,770 --> 00:02:23,890 So in other words, you will disable parallel scanning. 29 00:02:25,020 --> 00:02:30,690 So to do this, it's necessary to scan with and map in either to zero or two one mode. 30 00:02:32,160 --> 00:02:36,540 But do you remember that he, 021, will take a much longer time to scan? 31 00:02:38,600 --> 00:02:39,380 Searsport. 32 00:02:40,590 --> 00:02:45,660 So another method is to scan packets directly through a port with an map. 33 00:02:46,740 --> 00:02:50,130 We can make and MAP Act as an HTP service. 34 00:02:51,610 --> 00:02:56,140 Many apps and ideas systems allow packets sent through Port 80 to pass through. 35 00:02:58,480 --> 00:03:02,320 But unmap must be used with the sauce port parameter. 36 00:03:04,360 --> 00:03:12,530 So let's do an example, turn on virtual machines that we have installed, open virtual box, open calisthenics, 37 00:03:12,820 --> 00:03:22,480 then that zero two one five open one to ten dot zero to seven open windows, seven 10 dot zero dot to 38 00:03:22,480 --> 00:03:25,600 that six log to Linux VM. 39 00:03:26,490 --> 00:03:32,400 Username root, password her and open terminal and then write this command. 40 00:03:33,340 --> 00:03:39,640 And map and zero dot two, not six Searsport 80 recentre. 41 00:03:40,640 --> 00:03:42,830 And there your scan results. 42 00:03:47,570 --> 00:03:49,610 Randomized scanning order. 43 00:03:51,410 --> 00:03:56,030 So another method is to randomly select the hosts to be scanned. 44 00:03:57,230 --> 00:04:03,170 And map, it will scan the threads in sequence when used in default or normal scanning. 45 00:04:04,340 --> 00:04:10,190 So in this case, the safety systems may interfere with a thread on which and in storm. 46 00:04:11,280 --> 00:04:16,440 So in order to prevent this, we can provide random selection of strings to be scanned within map. 47 00:04:18,300 --> 00:04:23,680 So for random scanning, we can use the randomise host parameter within Matt. 48 00:04:25,380 --> 00:04:30,870 And I'll give you an example, if you turn on the virtual machines we have installed, open virtual 49 00:04:30,870 --> 00:04:38,550 box open callisthenics, 10 zero that to out one five, open a one to 10, zero to seven. 50 00:04:39,240 --> 00:04:42,480 Open Windows seven 10 dot zero two dot six. 51 00:04:43,170 --> 00:04:52,950 Open Métis voidable Tanda zero two not for long Anarkali Linux VMS username root password tours open 52 00:04:52,950 --> 00:05:03,450 terminal and write this command and map 10 zero 2.0 zero 24 randomise hosts press enter. 53 00:05:04,500 --> 00:05:06,330 And the scan results follow. 54 00:05:07,550 --> 00:05:14,930 So as you can see, it didn't scan in any order, it randomly scanned all of the IP addresses. 55 00:05:16,450 --> 00:05:17,680 Mac address spoofing. 56 00:05:18,900 --> 00:05:25,440 So another method of bypassing firewall restrictions when board scanning is to emulate the Mac address 57 00:05:25,440 --> 00:05:26,520 of another computer. 58 00:05:28,690 --> 00:05:34,510 This technique can be very effective, especially if there is a Mac filtering rule that only allows 59 00:05:34,510 --> 00:05:36,670 traffic from certain Mac addresses. 60 00:05:37,420 --> 00:05:43,300 So you will need to discover which Mac address you need to set in order to get the correct result. 61 00:05:44,270 --> 00:05:52,580 So specifically, the spoof Mac option allows you to select a Mac address from a specific vendor, select 62 00:05:52,580 --> 00:05:57,710 a random Mac address, or set a specific Mac address of your choice. 63 00:05:59,110 --> 00:06:05,410 Another advantage of Mac address fraud is that you make your browsing more confidential because your 64 00:06:05,410 --> 00:06:09,190 actual Mac address does not appear in the firewall log files. 65 00:06:11,910 --> 00:06:23,160 Command specify Mac address from a vendor and map spoof Mac Dell, slash Apple, slash 3Com IP Target. 66 00:06:24,780 --> 00:06:30,150 Generate a random Mac address and map spoof Mac zero IP target. 67 00:06:31,770 --> 00:06:42,210 Specify your own Mac address and map spoof Mac zero eight zero zero two seven zero zero zero zero zero 68 00:06:42,210 --> 00:06:43,860 six IP Target. 69 00:06:45,810 --> 00:06:47,070 And here's an example. 70 00:06:50,120 --> 00:06:52,850 Turn on the virtual machines that we have installed. 71 00:06:53,840 --> 00:07:01,970 Open virtual box open can only then extend out zero to one five open Métis voidable 10 dot zero dot 72 00:07:01,970 --> 00:07:09,200 do that for logging in county Linux, VMS, username root password tours and open terminal. 73 00:07:10,450 --> 00:07:21,010 And then right, this command and map, S.T. p.m. spoof Mach 3Com, 10 dot zero two dot four press enter. 74 00:07:22,390 --> 00:07:24,220 And this scan results from. 75 00:07:25,480 --> 00:07:31,540 So Unmap generated the Mac address of 3Com and scanned it using this Mac address. 76 00:07:33,310 --> 00:07:39,400 And it changed the IPV for lifetime or MTU value and sent packet's. 77 00:07:41,420 --> 00:07:49,250 So Unmap gives the user the option to set a specific MTU, which is the maximum transmission unit to 78 00:07:49,250 --> 00:07:49,770 the package. 79 00:07:50,870 --> 00:07:54,520 So it's similar to the packet fragmentation technique. 80 00:07:56,540 --> 00:08:00,830 During scanning and map will create packets based on the number of empty use. 81 00:08:00,860 --> 00:08:01,490 We provide. 82 00:08:02,490 --> 00:08:09,660 For example, if we set the MTA to 16 and m'appelle generate packets of 16 bytes and cause confusion 83 00:08:09,660 --> 00:08:15,510 on the firewall, please note, though, that the MTA new value must be a multiple of eight. 84 00:08:16,290 --> 00:08:18,830 So eight, 16, 24, 32 cetera. 85 00:08:21,050 --> 00:08:22,070 So here's an example. 86 00:08:23,360 --> 00:08:27,140 Turn on the virtual machines we have installed open virtual box. 87 00:08:28,040 --> 00:08:37,560 When can we then extend out zero to that one five open wound to 10, down zero two to seven organically, 88 00:08:37,580 --> 00:08:45,700 then ICBM's username root password tours, open terminal and write this command and map empty. 89 00:08:45,710 --> 00:08:51,140 You 16, 10 zero to dot seven press enter. 90 00:08:52,140 --> 00:08:53,910 And the scan results follow. 91 00:08:57,400 --> 00:08:58,990 Sinbad checksums. 92 00:09:00,900 --> 00:09:03,810 Is another way to circumvent security systems. 93 00:09:04,770 --> 00:09:07,410 Send incorrect check some packets. 94 00:09:08,470 --> 00:09:14,410 Now, many security systems ignore faulty packets, especially due to performance problems. 95 00:09:15,580 --> 00:09:22,180 So by taking advantage of this incorrect behavior, we may be able to send incorrect checks, some packets 96 00:09:22,180 --> 00:09:22,840 within BAB. 97 00:09:24,230 --> 00:09:32,020 And you can use the unmap bad, some target command to send packets to destinations that have failed, 98 00:09:32,420 --> 00:09:33,650 checked some packets. 99 00:09:35,120 --> 00:09:36,310 So I'll show you an example. 100 00:09:37,350 --> 00:09:43,170 Turn on the virtual machines we have installed, open virtual box, open, carry Linux and at zero, 101 00:09:43,170 --> 00:09:46,760 lattitude out one five, open one, two and zero. 102 00:09:46,770 --> 00:09:50,490 That 247 log in to County Linux VMS. 103 00:09:51,760 --> 00:09:54,250 Username root password tour. 104 00:09:55,260 --> 00:09:57,810 Open terminal and right this common. 105 00:09:58,700 --> 00:10:04,400 And map bad some then dot zero dot 2007 press enter. 106 00:10:05,580 --> 00:10:08,160 And there are the scan results. 107 00:10:12,910 --> 00:10:13,780 Fragmentation. 108 00:10:15,240 --> 00:10:19,830 So yet another method is to shred the scent packets into smaller packets. 109 00:10:21,310 --> 00:10:24,790 To do this, we can use the F parameter and map. 110 00:10:26,050 --> 00:10:32,200 For example, if you turn on the virtual machines where you have installed open virtual box open calisthenics, 111 00:10:32,740 --> 00:10:42,640 then that zero two one five open one to 10, zero dot to seven organically Linux VMS username root password 112 00:10:42,640 --> 00:10:45,670 to her open terminal and write this command. 113 00:10:46,530 --> 00:10:51,570 And Matt, f 10 zero to seven press enter. 114 00:10:52,640 --> 00:10:55,100 And there are your scan results.