2

I have Kali Linux installed in VirtualBox and would like to do an idle scan. For this I need to find a suitable zombie PC. I'm using the ipidseq script to find one. The script finds some IP addresses along with open ports. Unfortunately I executed the idle scan many many times with Zenmap( nmap -sl zombieip -p -pN targetip ) and always get the same response from Zenmap, that the port on the zombie IP cannot be used, "perhaps it's down or firewalled".

My question is: should I continue trying, but with a script to automate the process, or could I be doing something wrong?

Improve this question
1
  • What OS is running on your zombie? Are there any software firewalls on it? Have you looked at the traffic with tcpdump/wireshark to see what's going on?
    – David
    Commented Jun 14, 2014 at 3:31

2 Answers 2

Reset to default
2
  • For an idle (zombie) scan to work you don't actually care about the ports being opened or closed in your zombie machine that you want to relay on for your scan.
  • You care about the IP sequence number: if it is incremental your zombie target is a good candidate for your scan.
  • IP seq number is usually random, but some printers don't randomize it enough in their printing protocol's pings each few seconds, so you can exploit this to use it for your scan.

This is what happens when a zombie machine is not randomizing its TCP/IP seq number and the port is open in your targeted machine, the one to be scanned:

Idle Scan

Note that if there is a stateful firewall between you and your zombie machine it will block any SYN/ACK packets without previous initialized connection so you should seek another zombie where firewall is not blocking your forged SYN/ACK packets.

Another option is to send a SYN instead of a SYN/ACK, but I am not sure if this is possible in nmap. You may want to build your own scanner with hping3

Improve this answer
2
  • Thanks for your answer @AK_. I don´t have experience scanning, but I do understand the basics. I suppose then that to avoid manually transferring the zombie ips found by the ipidseq script, I should create a script to (nmap) idle scan the target with those zombie ips. I have done this manually about 250 times, but not a single idle scan was successful, all firewalled...
    – Nelis
    Commented Jun 14, 2014 at 15:40
  • Your operating system is the one that generates IP IDs I guess that is why your idle scan are not successful. It would be possible to write a script that generates those packets using raw generation.
    – AK_
    Commented Jun 14, 2014 at 16:07
0

When doing the idlescan, you can specify one of the open ports on the zombie machine. By default it attempts to use port 80 (according to the manual). Typically the command you'll enter may be like:

#nmap -sI [zombie IP address] [target IP address]

but now, all you need to do is add the zombie open port number to the command like:

#nmap -sI [zombie IP address]:[open zombie port number] [target IP address]

with values:

#nmap -sI 192.168.1.3:31337 192.168.1.9

This worked for me in Backtrack 5's nmap so I'm assuming it will work in Kali too.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .