5

Just a quick question. I run http server and when i scan it with classic "nmap -T5 -O -v [IP]" i see absolutely nothing in log. But when i do "-A" instead of "-O" i see lots of things that are OBVIOUSLY coming from nmap scan. In the user agent is "Nmap Scripting Engine" and few other things are there. Why isn't it at least try to hide itself ?

It's obvious that doing "-A" is gonna be noisy but it could be at least 'a bit less' noisy. Also, how do i change those defaults ? Thanks

4

The decision whether to try to avoid detection by default or to provide unique traffic signatures is a tricky one. In the long run, it becomes an arms race, where the attacker must always keep up with the defender or risk detection. Nmap has historically offered means of evading specific types of detection, but has not turned them on by default: packet fragmentation, source port spoofing, connection throttling, Idle/zombie scanning, etc. The capability is there, but the default is to be honest about what we are attempting to do.

NSE scripts have similar capabilities: you can slow them down with --max-parallelism and related options. You can change the user agent string with the http.useragent. You can send your traffic through a proxy with --proxies. But by default, Nmap is very honest about being Nmap.

The trouble is that if any of these behaviors were made the default, they would cease to be stealthy. When Nmap was first written, its default TCP scan mode, half-open SYN scan, was the stealthiest thing around, because the TCP handshake was never finished, so there was nothing in the server's application logs about a closed connection. But as this scan mode became so much more popular, network IDS capability soon expanded to catch it, since the "SYN, SYN-ACK, RST" behavior is so very unusual and noticeable. But Nmap didn't change its default simply to avoid IDS. Instead, it kept the reliable method that had the least impact on ignorant systems—you might be surprised to know how many daemons will crash if you simply connect and hang up (-sT).

I've written a more thorough analysis of Nmap's defaults, how they can be detected, and how to change them to avoid detection. It's on my blog in a two-part article called "They see me scannin'". I have a feeling you would find it interesting.

  • Ahh i see. I'm definitely gonna read it. Thank you for the awesome answer – ShinobiUltra Mar 28 '17 at 20:18
2

This option enables some mechanisms that can become quit noisy.

-A: Enable OS detection, version detection, script scanning, and traceroute

Version detection establishes a connection to every open port and fetches the banner to determine which daemon is running on that port and in which version.

Script scanning enables the usage of nse scripts which can be very noisy. Which scripts are used depends on the previos information regarding to open ports and services. For example in a LAN with windows workstations this most likely trigger a number of SMB related scripts which will partly try to use NULL Sessions for example.

2

Nmap can use a multitude of different ways to scan a target. bonsaiviking has well explained why nmap is noisy with the -A option.

Your ability to remain stealthy is to use a non-default nmap scan: My recommendation is to write your own nmap command line and call it with an alias.

Scan Type: Default -sS. You can use -sT, -sU, -sF, -sN, sX, or write you own scan type with

--scanflags

Timing: Use non-aggressive and unique timing settings. Rather than relying on preset (T0, T1, T2, T3, T4, T5). Set your own timing options:

--max-rtt-timeout *****
--max-parallelism *****
--min-hostgroup *****
etc...

enter image description here

Modify default header:

-f (fragment packets); --mtu (using the specified MTU)
The -f option causes the requested scan (including ping scans) to use tiny fragmented IP packets.
The idea is to split up the TCP header over several packets to make it harder for packet filters, intrusion detection systems, and other annoyances to detect what you are doing. Be careful with this! Some programs have trouble handling these tiny packets.

--data-length <number> (Append random data to send packets)
Normally Nmap sends minimalist packets containing only a header. So its TCP packets are generally 40 bytes and ICMP echo requests are just 28. This option tells Nmap to append the given number of random bytes to most of the packets it sends.
OS detection ( -0) packets are not affected because accuracy there requires probe consistency, but most pinging and portscan packets support this.
It slows things down a little, but can make a scan slightly less conspicuous.

--ttl <value> (Set IP time-to-live field)
Sets the IPv4 time-to-live field in sent packets to the given value.
*From the book Nmap Network Scanning, Gordon “Fyodor” Lyon*

To be considered: (not related to the question)

  • Active fingerprinting can always be detected. Favorite passive fingerprinting if possible.

  • You may want to be stealthy or accept being noisy if using spoofing techniques.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.