[lady_godiva]

Hi everybody,

Today i am going to show you how to perform a stealth port scan using Nmap

Why: when performing a penetration test, we need to emulate the attacker as much as possible. Most of the attacker will use these stealth techniques for a lower detection rate chance or to bypass firewall. In order for our penetration test results to be accurate, these techniques should be used too when performing the Information Gathering step.

Introduction: In order to perform stealthy port scan, we must violate the RFC (Request for comments), which means sending malformed TCP packets. Take a look at the TCP packet structure:

What we are going to do is sending a TCP packet with particular combinations of URG, ACK, PSH, RST, SYN, FIN. These 6 fields are single bit fields and they are used when estabilishing a connection (3 way handshake) and when closing it (URG and PSH to manage connection).
For those who don't know: URG = Urgent (not very used), ACK = Acknowledgment, PSH = Push (used to manage packets), RST = Reset, SYN = Synchronization packet (used to initiate the 3 way hanshake), FIN = Finish.

Setting particular combinations of these flags, we can get the host to tell us wether a certain port is opened or not.

Types of scans:

• SYN Scan: also referred to as Stealth or Half Open scan. This scan sends a TCP packet with the SYN flag set to initiate a 3 way handshake. If the target replies with a SYN-ACK than we can assume that the port is opened, if a RST is received than the port is closed.
  Nmap syntax for this scan is:
  
  
  Code:

  nmap -sS target_ip_address

• FIN Scan: This type of scan involves sending a packet with only the FIN bit set. RFC states that FIN flag should only be set when closing (properly ending) a communication between 2 machines. RFC also states that when a packet with FIN flag set against a closed port is received, a RST packet should be sent back, instead, if the port's opened, nothing should be received as FIN is not part of 3 way handshake. This way we are able to determine which ports are opened and which ports are closed.
  Nmap syntax for this scan is:
  
  
  Code:

  nmap -sF target_ip_address

• Christmas Scan: Also called Xmas scan, it involves sending a TCP packet with the FIN, URG and PSH bits set, which is a combination that should never occour according to RFC. The way it works its the same of the FIN scan, so RST if port is closed, nothing if it's open. The difference between FIN and XMAS scan is that one might work and traverse firewall while the other one not and viceversa.
  Nmap syntax for this scan is:
  
  
  Code:

  nmap -sX target_ip_address

• Null Scan:: according to RFC a TCP packet should always have at least 1 bit set. Null Scan involves sending a packet with no set bits. It attempts to break firewall rules based on certain flags combinations. Again, if RST is received than the port its closed, if nothing's received, we can assume the port's opened.
  Nmap syntax for this scan is:
  
  
  Code:

  nmap -sN target_ip_address

• ACK Scan: This scanning technique is not involved in determining which ports are opened and which are closed. It is used to circumvent packet filtering firewall , routers and proxy servers. It will not bypass a stateful inspection firewall. This can can be used for network discovery and more important, to determine firewall rulesets, determining if they are stateful or not and which ports are filtered. In my opinion it should be done as the first scan technique as can reveal important information that could be applied to other scanning techniques.
  Nmap syntax for this scan is:
  
  
  Code:

  nmap -sA target_ip_address

Bypass Firewall: different techniques can be used to ATTEMPT bypassing firewall.
One of the best attempts would be to split the TCP packets in more packets, making detection harder as packets have to be reassembled. In order to perform this technique just use the -f option:

Code:

nmap -f "scan_type" "target_ip_address"

This is a very long and complex topic, which i can't fully cover in a single post. This example is just to give a small idea.

General Notes:

• Please remember that none of these scanning techniques are 100% reliable as firewall might detect the scan and provide false informations about the target host, which is why determining the firewall rulesets is the first thing that should be done.
  
• There is an additional technique which is the IDLE Scan. I didn't cover it on purpose but for those interested Google is your friend. The reason why i didn't cover it is that it doesn't work anymore as it is not possible to find a quiet host to probe.
  
• This tutorial shows an advanced way to used nmap, for a basic usage tutorial, follow @Ex094 guide: http://www.hackcommunity.com/Thread-Tuto...ight=nmap0
  
• Port scanning is just a step of the Information Gathering process, find out more here: http://www.hackcommunity.com/Thread-Tuto...-Gathering
  
• Big companies get hundreds or even thousand of port scans per day, so being stealthy might not be a priority sometimes.
  

I hope you found this thread useful, if you have to thank me just use the thanks button so that i don't get notified about thanking posts and can stay focused on answering questions (if any).

[Mst0P]

Great thread! I think the fragmentation of packets will be caught by most modern firewalls(I know you used it as a simple example but I just wanted to point it out). As far as I know this method used to be quite effective some time ago.

The topic of firewall evasion is complex and very interesting so I understand why you don't want to go into it here. I was wondering, though, do you have any plans on making a tutorial on firewall evasion? I find this topic very interesting but I couldn't find much about it while searching the forum. Firewall bypass could go extremely well with the information in here.

[lady_godiva]

Great thread! I think the fragmentation of packets will be caught by most modern firewalls(I know you used it as a simple example but I just wanted to point it out). As far as I know this method used to be quite effective some time ago.

The topic of firewall evasion is complex and very interesting so I understand why you don't want to go into it here. I was wondering, though, do you have any plans on making a tutorial on firewall evasion? I find this topic very interesting but I couldn't find much about it while searching the forum. Firewall bypass could go extremely well with the information in here.

Yes, firewall evasion techniques keep changing, so it's really hard to find a technique that works no matter what. I was thinking about making a thread talking about firewall evasion so i think i'll soon begin to prepare this but i will probably be assuming that the reader knows different types of firewall and how they work as this would be too long to explain every single firewall.

You are right about packet fragmentation, but just like all the other options it depends on firewall configuration. It's really common to find bad or outdated configuration so, depending on who you are pentesting, they might work or not!

[h3r0]

Great tutorial and great explanation on SYN, ACK, FIN, and XMAS techniques. Only issue I have with the tut is in the general notes you used the word "namp" instead of "nmap". You have the same typo again in your "Bypass Firewall" section.

s/namp/nmap/g