Firewalk through a Firewall on our subnet

Question

Having trouble firewalking. I am trying to determine all the open ports on my firewall/gateway. Here is my lab network diagram:

(Skip to the bottom of the following explanation for a direct list of my questions)

Configuration Details:

• Firewall is an ASA 5505 with static routes.
• The firewall will respond to ICMP echo requests at 192.168.1.2.
• The firewall has TCP port 31337 left intentionally open so that we can detect it as part of the exercise.
• The "Host" at 192.168.1.4 is acting as the "attacker" trying to determine the open ports.
• The "Attacker" is running Kali linux.
• The "Target" host is running Windows Web Server 2008 (not sure that matters).

Attempted Methods:

I have tried both the "Firewalk" tool by Packetfactory and also the Nmap firewalk script. Here are examples of the syntax I am using:

Nmap: nmap --traceroute --script=firewalk --script-args=firewalk.max-probed-ports=-1 192.168.3.11

CORRECT SYNTAX FOR NMAP: (solved this!) nmap --traceroute --script=firewalk 192.168.3.11 -p1-65535

• NMAP only scans common ports by default. The full port range must be specified.

I simply needed to add the nmap port scan switches in as those are not arguments that can be passed into the firewalk script. I'm still learning...

Firewalk: firewalk 192.168.1.2 192.168.3.11

Current Results of firewalking methods:

Nmap (This list is incomplete but shouldn't be - port 31337 has been opened intentionally on this firewall)

 Starting Nmap 6.47 ( http://nmap.org ) at 2015-03-17 11:15 EDT
 Nmap scan report for 192.168.3.11
 Host is up (0.0026s latency).
 Not shown: 987 closed ports
 PORT      STATE    SERVICE
 80/tcp    open     http
 111/tcp   filtered rpcbind
 135/tcp   filtered msrpc
 139/tcp   filtered netbios-ssn
 445/tcp   filtered microsoft-ds
 1720/tcp  filtered H.323/Q.931
 2000/tcp  filtered cisco-sccp
 5060/tcp  filtered sip
 49152/tcp filtered unknown
 49153/tcp filtered unknown
 49154/tcp filtered unknown
 49155/tcp filtered unknown
 49156/tcp filtered unknown

 Host script results:
 | firewalk: 
 | HOP  HOST          PROTOCOL  BLOCKED PORTS
 |_0    192.168.1.43  tcp       111,135,139,445,1720,2000,5060,49152-49156

 TRACEROUTE (using port 1025/tcp)
 HOP RTT     ADDRESS
 1   3.19 ms 192.168.3.11

Firewalk

 Firewalk 5.0 [gateway ACL scanner]
 Firewalk state initialization completed successfully. UDP-based scan.
 Ramping phase source port: 53, destination port: 33434
 Hotfoot through 192.168.1.2 using 192.168.3.11 as a metric.
 Ramping Phase:
 1 (TTL  1): *no response*
 2 (TTL  2): *no response*
 ...
 25 (TTL 25): *no response*
 Scan aborted: hopcount exceeded.

Questions:

• Why doesn't the "Firewalk" tool ever see the target gateway (firewall at 192.168.1.2)? Nmap appears to be able to.
• Why doesn't the Nmap firewalk script show me all the open ports?
• How do I configure the Nmap firewalk script arguments to ONLY check the firewall for port 31337 TCP? (figured this out! -p31337 or -p1-65535. Duh - see the corrected syntax above)

P.S. also thanks to "Gliffy" for the awesome online network diagramming tool :)

Answer 1

According to the man page, firewalk looks to need the following flags in order to properly scan when you are one hop from your gateway (as seen in your pretty Gliffy picture).

firewalk -d 49152 -r 192.168.1.2 192.168.3.11