How to red team against firewalled architecture?

Question

Prior Knowledge

I understand the types and differences between firewalls. I have (what I believe to be) a relatively good mental model of a firewall. I understand routing, iptables, signature detection, and tunneling relatively well.

The Question

What methodologies are used when attacking a firewall? Assuming you gain some privileged information regarding a server(RHOST) at a given location, and you are attempting to penetrate it from a client(LHOST), how do you determine the best method to bypass the firewall's protections?

I understand this is highly situational

I am more interested in what method is used to differentiate the disparate contexts that would imply a specific attack method (EG: I've read about firewalking with TTL and UDP, but how would one know this is useful?)

As a follow-up question: how can an attacker formulate an attack that they are sure will not be detected by network forensics before launching any packets? Does it require privileged knowledge of the firewall itself, or can it be done with no prior knowledge?

I would love a link to a book, ebook, website, article, journal, or otherwise technically oriented resource I can use to instruct myself with. If that isn't available I'd love a detailed answer - I really appreciate the help, but I'm having a very difficult time finding good, relatively current information regarding this topic.

Thanks,

Andrew

My References

-Checked Amazon extensively, only found books on "firewall configuration best practices"

-Hackerstorm released a 4$ Ebook on "secrets of firewall penetration for security professionals" which was just a very high level overview and contained very little useful information

-Read an article from 1998 on firewalking using UDP but it seems like a 15 year old resource might not be relevant any more: http://packetfactory.openwall.net/projects/firewalk/firewalk-final.pdf

-Google'd around, found very little

-Ordered a book that seems promising, but it hasn't arrived yet: Advanced Penetration Testing for Highly-Secured Environments

Answer 1

There are endless ways to go about this, and no universal answer, whether you're talking about "attacking a firewall" or attacking "against a firewalled architecture" (you mention both). The key to successful attacks is to be creative and think about the big picture. If there was a book or simple answer about how to do this, it wouldn't be a problem that companies spend megabucks trying to solve.

Here are some useful thought processes to get you started: How is the firewall configuration managed? Who manages it? How is its software updated? How do authorized users tunnel through it? Who are the authorized users and what other software do they run? What are the services exposed publicly by the firewall? Do those services have vulnerabilities? What types of systems are behind the firewall? Where do they connect out to, why, when, and using what kind of software? Where is the firewall physically located?

If you're actually worrying about whether a specific attack is useful or not (why aren't you trying it right now?) or trying to determine which attack one can be "sure" is undetectable, you're way out of your league.

Answer 2

In regards to your question about launching packets with fear of being detected, NMAP can deal with these sorts of things (for scans only of course).

See Firewall/IDS Evasion and Spoofing