Nmap - Locating Idle Scan Zombies and FTP Bounce Servers
So, having read my previous posts on Idle Scanning and FTP Bounce, you may be interested in finding useable boxes. Now, as I suggested, you could scan for printers or other embedded devices, they make fucking AMAZING Idle Scan hosts. However, there is an nmap script here which is excellent for checking a host to see is it useable, by checking how its IPID sequence works. Meet ipidseq.nse ipidseq.nse is basically a test script, that tells you if you can use a host for Idle Scans. So, assuming you want a fair few zombies, lets scan 1000 hosts in the hope of finding a few good ones! root@bha:~# nmap -iR 1000 --script ipidseq -T5 -v -oA zombies The above scan will scan 1000 random IP addresses using the ipidseq script, testing them to see are they useable as zombies. I am using T5 here as scanning ranges slowly is BORING :P The -oA zombies will create three "Output Files". zombies.xml (XML format of scan), zombies.nmap (normal output), and a third "grepable" version - zombies.gnmap. You can then extract the useable hosts from said list using grep or similar, or just scroll through, copy, paste, like myself... "So we found us some Zombies. What about those Bouncy FTP servers then?" Well, nmap again has the solution to this problem. The ftp-bounce.nse script. We will use it in a very similar manner to the ipidseq script... root@bha:~# nmap -iR 1000 --script ftp-bounce -T5 -v -oA bouncyFTP This does the same as above, except instead it outputs lists of FTP servers we can "Bounce" via! Useful, no? BONUS ROUND! Finding Anonymous FTP Servers for stashin' yo' warez! So. Say you want to store/share a bunch of files and need some storage, or just like rummaging through open FTP servers (likely in search of other peoples warez and such... Never know, might find someones super secret 0day stash!). How do we go about doing such a thing? Well, Guess what? nmap, yet again, solves this problem with the ftp-anon script. Now, as above, you simply use it like so... root@bha:~# nmap --script ftp-anon -T5 -iR 1000 -v -oA ftpAnon Remember - with these you can always scan actual *ranges* instead of my "scan 1000 random hosts" idea, and this is VERY useful for auditing internal networks! Or some specific target networks... I know some web hosting firms may be VERY interested in scanning their own ranges for anonymous FTP setups to detect illegal piracy and such! Remember, ask before you scan!
