Using nmap to bypass a firewall and perform OS fingerprinting

Question

How can I use nmap to perform operating system detection on a system which has all of its ports filtered by a firewall?

Is there a way to bypass it?

I have tried: syn scan, xmas scan, fragment scan, service version detection (-sV), and nmap nse script scan. When I performed the scans, the reply that I got was the same in all the cases. I cannot provide the exact response but it was something like this: " ****host is up" "all the 1000 ports are filtered****".

Answer 1

The answer depends on what you are targeting to some extent. If there is an Internet-facing port on the host your scan may be blocked by the firewall responding with resets (RST) which makes your initial scan results look closed or filtered even though that may not be entirely true. Firewalls are designed to make this harder and can block some scans but if at least one port is available for testing you have a very good chance of figuring it out.

That said you will have to focus on information like the type and versions of applications running on the system. Use nmap to focus on the ports that are open and increase verbosity and look at the service versions.

nmap -Pn -vvv -sV -p 80 #(webserver) or
nmap -Pn -vvv -sV -p 22 #(ssh, hopefully on another port)

and you will see outputs that include lines like

22/tcp open  ssh     syn-ack OpenSSH 5.9p1 Debian 5ubuntu1.8 (Ubuntu Linux; protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

This can help you identify the host even if general port scanning will not.

Note: you can also take this a step further by analyzing the protocol traffic itself or content available via the applications exposed.

Additionally an nmap FTP bounce scan can also scan other servers behind a firewall:

https://nmap.org/nsedoc/scripts/ftp-bounce.html

nmap -vvv -b -PN :@