Packet-filtering firewall evasion (Scanning)

Question

Context

I'm very familiar with different applications of scanning tools (. . . and you can use -mtu to specify the size of the fragments in nmap . . .) but every piece of information I read about scanning and enumeration seems to always conclude with " . . . but this is only effective against old or poorly configured firewalls . . ."

Question

Where can I get information about some of the more advanced scanning techniques that would be effective against modern, well-configured firewalls?

Post-script

. . . or at least some information on the order of: "regardless of the firewall's configuration or age, X, Y, Z will at the very least give you information about S, R, T, which can be used to discern L, M, and N"

I'm looking for a resource primarily. Books cost $$ and I understand that, so I'm not anti-books.

Answer 1

There are some academic papers on the subject, but they don't tend to address evasion.

The reason you keep seeing the caveat "old and poorly configured" is because it holds pretty true - there is a limited set of 'valid' connections and connection types, and it's entirely possible on modern firewalls, properly configured, to enumerate them all and simply ignore all other types (even if that's not what the user did explicitly).

Cisco IOS, to take the most famous example, is decades old, and TCP/IP just hasn't changed all that much; so there's been an awful lot of time to harden it against unwanted traffic (especially since that's a firewall's core competency).

Additionally, devices are also fast enough now that even very complex rules don't cause much overhead in most installations and so some of the old "packet X takes 50x longer to process than packet Y" indicators just don't work because 50x slower is still faster than the clock on the wire.