I am trying to automate my recon process. For port scanning, I resolve subdomains to IPs then loop over those IPs with masscan. But is it worth it to port scan an asset that is hidden behind a web firewall? In other words, by doing this I'm scanning the WAF IPs. Is it a common thing that some subdomains are behind a WAF and others are not? In this case, I can perform a WAF check before performing the port scanning process.
-
subdomains can be in different parts of the world and on different hardware entirely...– schroeder ♦Aug 15, 2021 at 18:17
-
By WAF don't you mean load balancer?– KateFeb 10, 2022 at 10:49
Add a comment
|
3 Answers
There are lots of reasons to still do port scanning against an asset behind a web app firewall (WAF).
A port scan is partially a test to make sure the network (not WAF) firewall rules are correct. Let's say the DNS has been changed so that all your users have their traffic go through the WAF IP. The admins are then supposed to cut off access directly to the origin IP address and force everyone to go through the WAF. But did they? A port scan against the origin IP address can tell if any web ports are still open to the world.
WAFs protect the web ports. If the asset in question has other services, they might have vulnerabilities that the port scan can detect.
Performing a WAF check before port scanning is better to streamline your reconnaissance process. While some subdomains may be protected by a WAF, others may not, and scanning both can provide a more comprehensive view of an organization's security posture.
Yes, port scanning is a good idea for the following reason: To confirm what you think you know.
Most folks have a pretty good idea of how their network infrastructure should work. Port scans tell you what is actually happening.
One other thing I'll do is setup a small system, say a Raspberry Pi, with a few open ports (80, 443, etc.) and ensure there's no reason anyone should ever want to access this machine. I'll configure it such that if anyone ever does hit an open port, it alerts the Intrusion Detection System. It's a classic Honey Pot... which is intended to catch flies and anyone (other than you) scanning your network.
-
2I think you misunderstood the question. The question is not whether scanning is useful, but whether if trying to scan something that you can't scan directly is useful. The answer previous to yours actually addresses this. I think your answer is too vague if you were trying to provide a similar answer. And I'm not how your steps to set up a honeypot are relevant to the question.– schroeder ♦Feb 11, 2022 at 7:44