I was reading Nmap documentation about firewall evasion here. I already know that it is possible to use a proxy to make a scan (with the proxy chains). But with the option -S it is possible to spoof an IP adress. Isn't it the same ?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Scanning through a proxy allows you to scan from the IP of that proxy, and it only works with certain scan types, as you're just tunneling traffic through a proxy server. Connect scans are the obvious example of a scan type that works via a SOCKS proxy.
-S allows you to explicitly set the source IP address that your scan's IPv4 (or IPv6) headers contain. You can't do this with a proxy scan. If you're actually trying to scan something, the only useful reason to use
-S is to set your source IP when nmap can't figure it out itself.
Alternatively, you can make it look like an nmap scan is coming from another system on the network, in order to confuse a defender and waste their time. However, since the target server will reply back to the IP address in the source header, you won't see the response packets from the server, so it won't function as an actual port scan and nmap isn't likely to return useful results.