Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If you run an Nmap FTP bounce scan with nmap -O -b, nmap will do the scan, but it says that the scan "seems silly" before it starts. Why would the scan be silly?

It actually appears to report a ton of results for what ports are open, although the OS it reports is different from the OS that is reported if I run the nmap -sT -O -P0 option.

Why would the OS it reports be different for the bounce scan than for the TCP Connect scan? Is there some reason the bounce scan is unreliable?

share|improve this question

1 Answer 1

up vote 9 down vote accepted

FTP has a "feature" in it that allows one party to request that the FTP server send a file to another party, in effect acting as a proxy. This is really a vulnerability: if that feature is enabled on an internet-facing FTP server then that server could be used as a jumping off point for attacks on whatever the FTP server can connect to. This "feature" has long been deprecated and you're unlikely to find any FTP servers using it, although you never know.

When you use -b you are supposed to put the IP address of a vulnerable FTP server after the -b to act as a proxy. If you haven't put an IP address after it nmap won't have an FTP server to bounce through, so the option isn't used, so it would be silly to put -b without an IP address after.

If you have put an IP address after the -b, and the IP really is an FTP with bounce enabled, then the effect of the proxy would be to skew any OS fingerprinting so the results wouldn't be valid. Any OS fingerprinting done through any sort of proxy cannot be trusted, so using -O while using FTP bounce would also be silly.

share|improve this answer
    
Thank you for this answer. I apologize but I either didn't see it or didn't understand when I originally saw it. Anyway, it's accepted now. –  KyleM Feb 27 at 17:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.