Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I can access each page of a site through the browser (firefox). I can also see the ip and port address in firebug, but when I open cmd->ping site ->it says "request timeout".

I also tried traceroute. The trace was something like this

  1. my router
  2. some local-server
  3. server out of state
        • request timeout
  4. request timeout

But at the same time, I can access the website through the browser.

How do they do this, and how can I break it or get past it?

share|improve this question
add comment

3 Answers

up vote 6 down vote accepted

How to Break

To answer your question about 'how to break' - the easiest way is to use a 'ping' program that uses other protocols and/or other options.

hping3 is in Backtrack (you said you used Backtrack, but hping3 is available for download), and it allows you to use TCP and UDP pings, and it allows you to use other ICMP types for pings.

TCP ping to port 80:

hping3 -S xxx.xxx.xxx.xxx -p 80 -c 1

UDP ping to port 53:

hping3 -2 xxx.xxx.xxx.xxx -p 53 -c 1

ICMP ping using the 'timestamp' type:

hping3 -1 xxx.xxx.xxx.xxx -C 13 -c 1

Other tutorials for hping here.

Why it works

The typical 'ping' program uses a predefined ICMP echo request. This is very useful for diagnostics, but it is also easy to predict and block. As you can see, there are other ways to get the same functionality of ping by using other protocols and ICMP types.

How do you block?

If you want to block the normal ping program, you block ICMP echo requests at the firewall. But, hping3 uses valid processes in the protocols you need to serve webpages, which means that you can't block it. If you want block even hping, then you would have to block hosts from your firewall, which is likely not something you want to do with a website you want to be publicly accessible. (Actually, there is a way to block the use of hping, but the user of hping would have to use the stock or invalid protocol settings of hping. With more networking knowledge, it would be impossible to block.)

What you need to know

It is important to understand that the issue here was not with your understanding of the tools available, but with your understanding of networking protocols. You will be a better network security person by reading things like TCP/IP Illustrated. By knowing what ping did, and what protocols it used, you would have been able to answer your own question.

Happy learning!

share|improve this answer
    
i can't upvote this cause it requires 15+ reputation. Anyways, thank you!! –  Pointer Apr 3 '12 at 7:21
    
If you felt that this was a definitive answer you were looking for, you could choose it. –  schroeder Apr 3 '12 at 15:53
    
numbering system of stackoverflow makes addict to this site. –  Pointer Apr 4 '12 at 11:35
add comment

As explained by other members, for best results you need to try other protocols over possible open doors and try firewall/ids evasion (e.g fragment packets).

This 'search' can be most effective using tools such as nmap eg:

nmap -sP -PE -PP -PS21,23,25,80,113,31339 -PA80,113,443,1042 -T4

where

-PE echo request

-PP timestamp request

-PS n tcp syn ping

-PA n tcp ack ping

-T3 normal -T4 agressive -T5 insane (danger)

If you want, you can execute a traceroute too, just add --traceroute. :)

share|improve this answer
add comment

Ping uses Internet Control Message Protocol, this also is used for other errors and stuff like preventing a packet ending up in an infinite loop around a group of routers. By blocking ICMP Echo Request packets or just not responding to them you can block a ping without blocking all other control codes.

Traceroute usually uses an echo request but sets the TTL (a number on all IP packets that is decreased each hop 'till 0 where router replies with an error) and awaits the error increasing the TTL by one to get the next hop 'till it gets a successful response or hits 30 hops (by default), to block this one has to be careful not to break the net by blocking legitimate errors.

TCP (with HTTP on top) is what one uses for and talking to websites, the only time ICMP would come into it is if a legitimate error happens like it ends up on a loop path and the packet TTL hits 0. Past that if all is working one would not even notice there is an issue by blocking all ICMP at the end point.

share|improve this answer
    
so there is no way to break this.And also it i want my website to have this feature how to do this? –  Pointer Apr 2 '12 at 17:20
    
You would typically block it at the firewall. –  Graham Hill Apr 2 '12 at 17:39
    
thanks for help –  Pointer Apr 2 '12 at 18:35
    
And breaking it usually depends on the firewall, or if there is another protocol that emulates the functionality (most games have their own internal pings). –  ewanm89 Apr 2 '12 at 18:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.