Prior Knowledge
I understand the types and differences between firewalls. I have (what I believe to be) a relatively good mental model of a firewall. I understand routing, iptables, signature detection, and tunneling relatively well.
The Question
What methodologies are used when attacking a firewall? Assuming you gain some privileged information regarding a server(RHOST) at a given location, and you are attempting to penetrate it from a client(LHOST), how do you determine the best method to bypass the firewall's protections?
I understand this is highly situational
I am more interested in what method is used to differentiate the disparate contexts that would imply a specific attack method (EG: I've read about firewalking with TTL and UDP, but how would one know this is useful?)
As a follow-up question: how can an attacker formulate an attack that they are sure will not be detected by network forensics before launching any packets? Does it require privileged knowledge of the firewall itself, or can it be done with no prior knowledge?
I would love a link to a book, ebook, website, article, journal, or otherwise technically oriented resource I can use to instruct myself with. If that isn't available I'd love a detailed answer - I really appreciate the help, but I'm having a very difficult time finding good, relatively current information regarding this topic.
Thanks,
Andrew
My References
-Checked Amazon extensively, only found books on "firewall configuration best practices"
-Hackerstorm released a 4$ Ebook on "secrets of firewall penetration for security professionals" which was just a very high level overview and contained very little useful information
-Read an article from 1998 on firewalking using UDP but it seems like a 15 year old resource might not be relevant any more: http://packetfactory.openwall.net/projects/firewalk/firewalk-final.pdf
-Google'd around, found very little
-Ordered a book that seems promising, but it hasn't arrived yet: Advanced Penetration Testing for Highly-Secured Environments