nmap: why is it “silly” to combine OS finding option (-O) with bounce scan (-b)

Question

If you run an Nmap FTP bounce scan with nmap -O -b, nmap will do the scan, but it says that the scan "seems silly" before it starts. Why would the scan be silly?

It actually appears to report a ton of results for what ports are open, although the OS it reports is different from the OS that is reported if I run the nmap -sT -O -P0 option.

Why would the OS it reports be different for the bounce scan than for the TCP Connect scan? Is there some reason the bounce scan is unreliable?

Answer 1

FTP has a "feature" in it that allows one party to request that the FTP server send a file to another party, in effect acting as a proxy. This is really a vulnerability: if that feature is enabled on an internet-facing FTP server then that server could be used as a jumping off point for attacks on whatever the FTP server can connect to. This "feature" has long been deprecated and you're unlikely to find any FTP servers using it, although you never know.

When you use -b you are supposed to put the IP address of a vulnerable FTP server after the -b to act as a proxy. If you haven't put an IP address after it nmap won't have an FTP server to bounce through, so the option isn't used, so it would be silly to put -b without an IP address after.

If you have put an IP address after the -b, and the IP really is an FTP with bounce enabled, then the effect of the proxy would be to skew any OS fingerprinting so the results wouldn't be valid. Any OS fingerprinting done through any sort of proxy cannot be trusted, so using -O while using FTP bounce would also be silly.