how to bypass windows xp firewall with nmap

Question

I'm scanning a Windows XP in a virtualized environment. I use all of needed arguments to bypass its firewall but it doesn't answer:

nmap -e eth0 -Pn --data-length 5 --badsum -g 80 -S 192.168.1.103 -f -T1 -D 192.168.1.200,192.168.1.30,192.168.1.45,192.168.1.90 192.168.1.102

This is the response:

all 1000 scanned ports are filtered

Firewall rules allow file and printer sharing plus some other ports. Is there any way to bypass?

Answer 1

The whole point about firewalls is that you cannot bypass them, if you could they wouldn't be doing their job very well.

That being said the scan you have set up is not optimal, you are spoofing your source address for one thing, so you won't be seeing return packets. Even if your packets get through you won't see a response (unless you are using -S with the correct IP address of your interface although that's almost never required). You are also using -D, which is probably useless in your case although I wouldn't expect it to hurt anything. Fragments and bad checksums aren't a bad idea, but what you are really missing is:

• Make sure you are scanning the ports you want to reach. Nmap by default doesn't scan all ports, it scans 1-1024 and then anything in the services file. If the ports you want to reach aren't there you will need to specify them using -p. You can also limit the scan to less ports if you have a set list you want to reach, which will save time
• If you want to circumvent firewalls you are unlikely to be able to do it in default scan mode, read this section on port scanning techniques