Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'd a scan task and I faced following result

Host is up (0.032s latency).
Scanned at 2012-10-25 16:06:38 AST for 856s
PORT      STATE SERVICE    VERSION
1/tcp     open  tcpwrapped
3/tcp     open  tcpwrapped
4/tcp     open  tcpwrapped
.
.
19/tcp    open  tcpwrapped
20/tcp    open  tcpwrapped
21/tcp    open  tcpwrapped
22/tcp    open  tcpwrapped
23/tcp    open  tcpwrapped
.
.
64623/tcp open  tcpwrapped
64680/tcp open  tcpwrapped
65000/tcp open  tcpwrapped
65129/tcp open  tcpwrapped
65389/tcp open  tcpwrapped

Scan methodology was

nmap -n -vv -A x.x.x.x --min-parallelism=50 --max-parallelism=150 -PN -T2 -oA x.x.x.x

I'm sure that this is a firewall's or loadbalancer's game. I tried many way such as change source port, source IP , fragmentation, etc..

  • Do you have any idea/suggestion to bypass this case?
  • on another hand, Do you know how to do that on firewall policy(on any firewall)? Thanks
share|improve this question
add comment

3 Answers

You are looking at trying to map out the firewall rules. 'Firewalking' tools might help with this, but I don't have high hopes.

  • Try slowing your speed. You are using T2, which is very fast and you might be getting odd results.
  • Try not using -A, but specify the -sV switch directly
  • Try looking for 'port knocking' opportunities
  • Try using a packet crafter, such as scapy or hping3 to really drill down into the traffic you send and try to map out what can get through.
share|improve this answer
add comment

This post describes tcpwrapped as something common with Windows hosts. Beyond that I'm not quite sure.

share|improve this answer
    
yes sir, I sow this post but it doesn't help –  KING SABRI Oct 31 '12 at 11:21
add comment

You could try using nmap -sV which will grab the header and version information. All TCP ports will still be open (obviously there is nothing you can do about that), but you could grep though and find interesting banners and go from there.

share|improve this answer
    
Thanks Rook but -sV is already included in -A. another thing I as you may know that this case shows whole ports are open so it more than though to guess which one is interesting ,, it's black box scan :) –  KING SABRI Oct 31 '12 at 0:48
    
@KING SABRI so then grep though the results –  Rook Oct 31 '12 at 1:20
    
There are no real result because its not real open ports ,, as you know there is not host have all ports open. –  KING SABRI Oct 31 '12 at 11:20
    
I think what @KINGSABRI is saying is that there is no real data to grep for due to the FW. The OP is about finding a way to get relevant data. –  schroeder Oct 31 '12 at 18:19
1  
@schroeder and grepping though the response is that way. If there is a real service it will have a header and -sV or -A will display that header. But if all the ports are actually closed then obviously a waste of time! –  Rook Oct 31 '12 at 18:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.