I want to be sure that the firewall protecting the intranet is effectively rejecting/granting access to a port. I have no access to the firewall nor any other external machine.
Is that possible at all?
I was relying on a web service I had setup on a machine outside, but I wondered if there's some other way. Is it possible to have a special TCP package sent with a modified header so it will be returned to a different port on the same machine?
EDIT: It's just one port, nmap is not really required.
An example of what I meant by special TCP package: The internal machine starts a TCP connection on port A to the outside but forges "somehow" the package so that the firewall recognizes the connection to the outside is being established from port A but the remote machine answers to port B. So perhaps the firewall assumes the ACK/SYN is the start of a new connection from the outside and treat it like such... would that be even thinkable?
EDIT 2: I've tried using the PORT command of FTP to tell a remote FTP server to send the data to a specific port on a specific machine. I couldn't manage to get it work:
ftp> quote PORT 127,0,0,1,178,148 ---> PORT 127,0,0,1,178,148 200 PORT command successful. Consider using PASV. ftp> get start_main_ws local: start_main_ws remote: start_main_ws ftp: setsockopt (ignored): Permission denied ---> PORT 127,0,0,1,155,88 200 PORT command successful. Consider using PASV.
It breaks and it automatically send a different PORT number which just works. It does look promising even though I can't make it work. (by the way this is just a local test as a proof of concept)