Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to scan open ports of a server. But as far as I know, when I try to scan the open ports with something like nmap in shell they would be able to trace me. Is there a way to secure this scanning to make sure they would not be able to trace back?

share|improve this question
5  
How do I measure the position of electron without affecting its momentum? –  Hubert Kario Sep 27 '12 at 10:58
    
@HubertKario I don't understand your sarcasm –  Erfan Sep 27 '12 at 13:18
    
@Erfan, it's a Heisenberg Uncertainty Principle joke, and as such the number of people on earth who truly understand it is probably counted on one hand. –  gowenfawr Sep 27 '12 at 13:34
    
@gowenfawr sorry for being pedantic, but it's the Observer Effect, not the Uncertainty Principle (for your credit, Heisenberg himself did confuse the two). Erfan: what I meant, is that the act of measuring leaves a trace behind. Its a property of the underling universe we all live in. As such, because the computers exist in the same universe (and you're not performing the test from outside the universe/simulation) you can't do it without leaving a trace, you can only minimise the effect. –  Hubert Kario Sep 27 '12 at 14:37
2  
"All data leaves a trail. The search for data leaves a trail. The erasure of data leaves a trail. The absence of data, under the right circumstances, can leave the clearest trail of all." Dr. Kio Masada as quoted in This Alien Shore by C.S. Friedman –  gowenfawr Sep 27 '12 at 14:42
show 1 more comment

4 Answers

up vote 2 down vote accepted

Along with the options already provided, the use of anonymous gateways can provide substantial cover for scans. Tor, for example, should provide enough entry and exit points that any trace is unlikely to be successful.

share|improve this answer
    
How would I be able to use TOR for protection of my scanning? –  Erfan Sep 27 '12 at 18:17
1  
Use proxychains or anything else similar to tunnel your traffic across the established tor connection: examples -- commondork.com/2009/06/26/tunneling-nmap-through-tor -- aldeid.com/wiki/Tor/Usage/Nmap-scan-through-tor –  iivel Sep 27 '12 at 19:15
add comment

Depending on the environment of your scan and where the server is located etc. You may be able to accomplish this using a TCP Idle Scan - http://nmap.org/book/idlescan.html

You could also do your scanning via a proxy http://funoverip.net/2010/11/socks-proxy-servers-scanning-with-nmap/

Both the above methods are more covert but neither is completely untraceable so do consider this.

Also you should consider legality of port scanning a system unless you have permission to do so - http://nmap.org/book/legal-issues.html

share|improve this answer
    
and FTP bounce scan... –  Rook Sep 27 '12 at 15:09
1  
@Rook But in that case you may leave logs on the FTP box. –  Polynomial Sep 28 '12 at 6:02
add comment

To 'scan' ports, you need to send traffic to the port to get a response. But, beside Idle Scans and proxies to get other targets to send the traffic for you, there are 2 other covert options to enumerate a target's ports:

  • passive sniffing
  • get the target to tell you

Sniffing the network allows you view traffic to/from various ports. As sniffing is passive, you could not be traced. This depends on active traffic from ports during the sniffing window.

The other option is most likely outside expectation, but I include for completenes-sake: once you obtain access to a target, you can query the target to tell you what ports are available. You might get a shell on a vulnerable web server through port 80, then run netstat to see what other ports are listening and on what interfaces. Traffic to the target shell is over normal channels (web traffic) and although traceable, can easily get lost in the noise. This avenue of enumeration is not to be overlooked.

Both of these options require you to be close to the target or have an exploit vector, but they have been helpful to me in the past.

share|improve this answer
add comment

There are two ways to make the scan nearly untraceable (only if the system under attack hasn't been configured specifically for detecting scans).

  1. perform it over long time (1 port probe every 24h, or longer, preferably intermixed with legitimate traffic)
  2. perform it using multiple computers (preferably 1 port per computer/IP)

The first one will take a long time (during which the firewall configuration can change) or will require massive amount of computers (and can hit per IP blocks instead of port blocks).

Continuing the quantum physics references: this is similar to the Uncertainty Principle ;)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.