First of all, this question is not the same as is it possible to test out remote host by using nmap?, because on that question, the questioner is asking for something impossible due to NAT's nature.

My question has the same goal, but going a little further. If I know that a host has the port 12345 opened for some reason, can I perform a scan which uses port 12345 to send the packets (so the packets go to the intended host due to port-forwarding) and be able to receive which ports are opened?


I believe that you are asking if you can take advantage of traffic for targethost port 12345 being allowed in order to scan other ports on targethost aside from 12345.

The answer to that question is essentially "no".

Is the answer ever literally "yes"? Actually, yes.

Once upon a time, it was possible to fool some packet filters and weak-brained firewalls into passing traffic. If I recall, the method was to send a series of overlapping packet fragments. The packet filter (often a router) would look at the first fragment and say "Ah! Port 12345! I allow that, come on in!" and would pass subsequent packets without examination. But what if the second packet fragment had an offset that overlapped where the destination port was defined? The targethost, unlike the packet filter, is going to reassemble the packet before parsing it to determine what port it goes to. If the targethost resolved the overlapping fragments by overwriting the original fragment (the port 12345 fragment) with the subsequent fragment (say, listing port 137) and boom! Assuming the response packet can get out (again, something packet filters tend to do, modern stateful firewalls tend not to do) then it would be possible to scan arbitrary ports behind a firewall, piggybacking on a single permitted port.

Modern firewalls aren't that stupid, so it's generally not possible to do what you want to do today.

(It also used to be not-uncommon for packet filters to pass traffic by source port. Yeah. It makes handling things like DNS and FTP easier when you don't have an application-aware stateful firewall. It also allows anybody who wants to to connect right through your firewall, as long as they source their packets from (say) port 53 or port 20.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.