4

I just got certified in CEH and learned A LOT about nmap and how it really manipulates the three-way-handshake to get some cool information.

I have a question about possible detection problems.

When you are sending a SYN packet, even as part of a -sS scan, does that packet carry your source IP? If so, couldn't your target record that connection attempt in the firewall log and trace the connection back to you? Or is it just an unspoken 'no duh' that you should also be spoofing your IP if you want to remind undetected? Or does namp do this automatically? Or does nothing get logged if the connection was unsuccessful and the three-way handshake not completed?

4

It does get traced back to your IP. However, this isn't really practically avoidable.

What you can technically do is a "idle scan" with nmap. I won't go into the technical stuff too much, but it's based off the side channel of IP ID being incremented. However, I've never heard of hackers actually using this method. https://nmap.org/book/idlescan.html

However, the internet is getting scanned so much, that there is no way for the admin to investigate every port scan.

On a local network, you'd want to slow it down a lot so it doesn't get detected as a port scan. That's what phineas phisher did when he hacked the hackteam. Even on the local network, there are many false positives when it comes to detecting port scans.

It's also possible to use IP spoofing or proxies to mask your IP address by hiding it among many other IP addresses. Furthermore, a proxy or VPN may be used for port scanning. This will completely hide your IP address from the target. You can also combine the two methods.

  • Thanks you two said basically the same thing--that's why the nmap -D flag is handy, the admin would have to investigate each and every IP. You said that you could use a proxy, would a VPN help with that? I know that my current VPN redirects all of my computer's network traffic (games, file sharing, etc...). – Tobin Shields Oct 5 '17 at 19:23
  • You would need many VPNs (with different IPs) to accomplish this, just like how you would need many proxies. However, with proxies, it's easier because there are many open proxies on the internet. I'm not sure about VPNs. – Daniel Grover Oct 5 '17 at 19:25
  • Probably better to just do the scan while connected to the VPN so it doesn't reveal your IP address at all. – Daniel Grover Oct 5 '17 at 19:48
  • An admin doing an investigation based on a port scan will have little time to spend doing anything else. The signal ("a port scan from X IP") is used as a data point in some other threat calculation or to trigger a block or throttle action. So decoys don't really help: the admin will block or throttle your real IP at the same time. – bonsaiviking Oct 6 '17 at 16:11
2

When you are doing a TCP syn scan, even with a half one, you have to give away one of your IP addresses to be able to get the answers.

So, spoofing would not help. Yet, there are two points to note here:

  1. port scans are not illegal in all jurisdictions, so knowing to be port scanned is nothing helpful, except for modifying firewalls.

  2. the IP address can be spoofed to a machine under the attacker’s control that is not associated with the attacker. This, by the way, makes the port scan even faster.

Additionally, with the background noise of port scans that is usual on the internet (and using -T0), it would take a pretty large firewall log and loads of computing power to trace some random syns to an actual portscan.

That being said: yes, nmap in normal mode is pretty noisy and easily detected by IDSs.

  • Interesting, so as a attacker/pen tester you are trying to 1) reduce that noise via nmap tools like -sS, -D, etc... and 2) rely on blending into other internet noise? Is it fairly safe to say that unless a strong IDS is configured specifically for namp that they go unnoticed? But there is still a risk of tracing an nmap scan back to an attacker? – Tobin Shields Oct 5 '17 at 19:21
  • 1
    Of course there is a risk. Additionally, every IDS will pick up on a standard nmap scan. That is, what -T0 (paranoid timing) is for. Yet, even if an IDS picks up on a port scan, most people will not act on it, as the internet gets scanned all the time. – Tobi Nary Oct 5 '17 at 19:25
1

Avoiding detection is a complicated topic, and it requires a solid understanding of the underlying networking concepts:

  • Networking happens in layers. Each must be considered separately to determine what information is being transferred.
  • A system will send replies to the address in the source address field. If you "spoof" this as something else, the replies will go there and you will not see them.
  • Anonymity is not always what you want. Anonymity means that you have no name or identifying information. But this can make you stand out in a crowd; the guy who walks into a bank in a ski mask is anonymous, but he is certainly not going to get very far. Instead, you want to be unnoticed, which requires a different set of behaviors and techniques.
  • "Modern firewalls" cannot be bypassed. There may be rules that allow some traffic, or there may be vulnerabilities in some other system that allow an attacker to pivot into the network, but generally speaking, the "firewall bypass" techniques in Nmap are exploits for vulnerabilities that have been fixed in any firewall for which people will pay money.
  • Blocking an IP is easy and cheap. If your target is willing to block you, they will be just as willing to block you and your decoys. Apart from that, there are techniques for discovering the "real" source of a decoy scan, so it's not foolproof.

I've written an analysis of detecting Nmap and avoiding detection on my blog, but I caution you to not view it as a "do this and it will work" list. Every scanning situation is different, and you really need to know the nitty-gritty of networking concepts before you start fiddling with Nmap options.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.