#obfustication

So, in part one 1 I briefly described several of nmaps IDS/IPS/Firewall evasion techniques, and in this installment (a brief one) I hope to quickly go over another amazing technique: The Idle Scan. This is also kind of a rough article to add to the nmap wiki page on http://blackhatacademy.org , which is reopening sometime soon with LOADS of AWESOME new content! Idle scanning is an INCREDIBLY sneaky scan technique which nmap can implement. The awesome thing about idle scan is that it allows you to scan a host WITHOUT EVER SENDING PACKETS TO IT. How this works is actually fairly simple, though I must admit it was pretty friggin mind-bending the first time I looked into it. Please note: Idle scans MAY still set off the victims IDS, so I advise -T0 with this, and a hell of a lot of patience. However, seeing as you are not really touching the victim at all (well, the packets don't seem to come from you, ever) it is fairly safe method. So, how DOES it work? Well, I must admit: I am NO expert on TCP/IP - I know a bit, but still have a lot to learn. But, essentially, it uses the IPID field in IP packets. In a basic sense, you find a host that is "idle" - i.e. little to no traffic coming to/from it, and that is your "zombie host". All scanning activities will APPEAR to be coming from this host. You send your scan packets TO the victim host (yes, you can use all the fragmentation and such I discussed earlier here, just I do not think traditional decoy's work - I will have to check this though), pretending to be the zombie host. Before you send a packet to the target, you send one to the zombie, to get its current IPID. Now for the cool part. When a box recieves a RST, its IPID does NOT increment/change as RST packets are not replied to (assuming the zombie host is one with a predictable IPID sequence - a lot of boxes just increment by one. Hint from ohdae - Printers!). HOWEVER, when a host receives a SYN-ACK, its IPID DOES change. So. When your scan hits an OPEN port on the victim, it replies with a SYN-ACK to the Zombie host. This causes the zombie's IPID to increment, and when you re-probe the zombie host, its IPID will have incremented. When you hit a CLOSED port on victim, it sends a RST to Zombie, and... Zombie's IPID does NOT increment. So, by slowly probing Zombie immediately before + after sending packets to the Victim, you can INDIRECTLY find out what ports on the Victim are open... Caveat: This scan does have some inherent "fudge factor" and inaccuracy, but by repeating the test a bunch of times you can solve this problem. nmap also seems to have some kind of "magic" that helps here... For more information on idlescan in nmap: http://nmap.org/book/idlescan.html Nmap's man pages make a PARTICULARLY interesting point: What if, you use Zombie(s) that you think might be considered "trusted hosts" by the victim? This is a VERY interesting way of navigating firewalls and such... Think it over... (Pointer: Say the victims have an exposed network printer that you KNOW is on their internal network. How about zombie scanning their intranet from the outside due to this misconfiguration? Shit like this is why guys like me look like friggin ninjas sometimes (also, yes, I am currently in a state of sleep deprivation, and exhausted. Cut me some slack :P )...) ANYWAYS, now to the usage: root@bha:~# nmap -sI zombie.com:23 -T0 victim.tld This would scan victim.tld, using zombie.com as its "Zombie Host", and sending the probes to Zombie on port 23 (note: you do need an open port on the zombie for this... The default is 80) I was going to write more, but then realized that I have not a lot more to say on this. Except that I will be re-writing it and drawing a diagram for the wiki article on Blackhat Academy. http://blackhatacademy.org If you want more of my mindless nonsense, see my website: http://insecurety.net/ :)