+- Sinisterly (https://sinister.ly)
+-- Forum: Computers (https://sinister.ly/Forum-Computers)
+--- Forum: Networking (https://sinister.ly/Forum-Networking)
+--- Thread: Anon synscans (/Thread-Anon-synscans)
Anon synscans - OldWolf - 07-11-2014
Getting a good scan is great, getting one without them finding you is better!
using nmap you can perform this task.
Reasons to do this
1. your ip does not come up in any logs on the target (will show in isp deep packet inspection)
2. your ip may be filtered by the target
3. you do not want to set off any alarms sending many network packets from the same address
useing the 'nmap -D' option you can specify the source address (example nmap -D 8.8.8.8 example.com). This would scan example.com spoofing the ip address 8.8.8.8 (googles dns server)
By putting RND in instead of a fake address, a random one is used. Furthermore adding many of these with comas to seperate them creates many fake addresses for the scan to originate from.
Last login: today 06:06:06 2014 from 1.2.3.4
user@localhost:~$ nmap -D RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND,RND example.com
Starting Nmap 6.25 ( http://nmap.org ) at 2014-07-11 02:05 GMT Daylight Time
Nmap scan report for example.com (93.184.216.119)
Host is up (0.39s latency).
Not shown: 993 filtered ports
PORT STATE SERVICE
53/tcp closed domain
80/tcp open http
443/tcp open https
554/tcp closed rtsp
1119/tcp closed bnetgame
1755/tcp closed wms
1935/tcp closed rtmp
Nmap done: 1 IP address (1 host up) scanned in 198.00 seconds
user@localhost:~$exit
its late now time for sleep
RE: Anon synscans - XERXES - 07-11-2014
Interesting. How does this work?
RE: Anon synscans - OldWolf - 08-13-2014
This boiled down to how internet protocols connect at the most basic level.
EXAMPLE: website connection!
When you enter a address in your browser after necessary DNS requests to find the ip, your computer sends out a SYN packet to port 80(webserver port) to the web site.
The server will then send back an ACK packet to say YES the port is open.
A series of back and fore packets occure before browser connection and page veiwing....but that do not matter in this explanation.
This only uses the first 2 packets
This scan sends out a single SYN packet to a pre-set list of network ports. each SYN packet has a FROM and TO address in it.
all this does is randomize the FROM IP in all the syn packets sent.
The trick is being as the ACK is sent along the connection the original SYN is sent through the acknowledgement is seen even from a spoofed address and the connection is left hanging with no response from the spoofed address.