Having trouble firewalking. I am trying to determine all the open ports on my firewall/gateway. Here is my lab network diagram:
(Skip to the bottom of the following explanation for a direct list of my questions)
- Firewall is an ASA 5505 with static routes.
- The firewall will respond to ICMP echo requests at 192.168.1.2.
- The firewall has TCP port 31337 left intentionally open so that we can detect it as part of the exercise.
- The "Host" at 192.168.1.4 is acting as the "attacker" trying to determine the open ports.
- The "Attacker" is running Kali linux.
- The "Target" host is running Windows Web Server 2008 (not sure that matters).
I have tried both the "Firewalk" tool by Packetfactory and also the Nmap firewalk script. Here are examples of the syntax I am using:
nmap --traceroute --script=firewalk --script-args=firewalk.max-probed-ports=-1 192.168.3.11
CORRECT SYNTAX FOR NMAP: (solved this!)
nmap --traceroute --script=firewalk 192.168.3.11 -p1-65535
- NMAP only scans common ports by default. The full port range must be specified.
I simply needed to add the nmap port scan switches in as those are not arguments that can be passed into the firewalk script. I'm still learning...
firewalk 192.168.1.2 192.168.3.11
Current Results of firewalking methods:
Nmap (This list is incomplete but shouldn't be - port 31337 has been opened intentionally on this firewall)
Starting Nmap 6.47 ( http://nmap.org ) at 2015-03-17 11:15 EDT Nmap scan report for 192.168.3.11 Host is up (0.0026s latency). Not shown: 987 closed ports PORT STATE SERVICE 80/tcp open http 111/tcp filtered rpcbind 135/tcp filtered msrpc 139/tcp filtered netbios-ssn 445/tcp filtered microsoft-ds 1720/tcp filtered H.323/Q.931 2000/tcp filtered cisco-sccp 5060/tcp filtered sip 49152/tcp filtered unknown 49153/tcp filtered unknown 49154/tcp filtered unknown 49155/tcp filtered unknown 49156/tcp filtered unknown Host script results: | firewalk: | HOP HOST PROTOCOL BLOCKED PORTS |_0 192.168.1.43 tcp 111,135,139,445,1720,2000,5060,49152-49156 TRACEROUTE (using port 1025/tcp) HOP RTT ADDRESS 1 3.19 ms 192.168.3.11
Firewalk 5.0 [gateway ACL scanner] Firewalk state initialization completed successfully. UDP-based scan. Ramping phase source port: 53, destination port: 33434 Hotfoot through 192.168.1.2 using 192.168.3.11 as a metric. Ramping Phase: 1 (TTL 1): *no response* 2 (TTL 2): *no response* ... 25 (TTL 25): *no response* Scan aborted: hopcount exceeded.
- Why doesn't the "Firewalk" tool ever see the target gateway (firewall at 192.168.1.2)? Nmap appears to be able to.
- Why doesn't the Nmap firewalk script show me all the open ports?
- How do I configure the Nmap firewalk script arguments to ONLY check the firewall for port 31337 TCP? (figured this out!
-p1-65535. Duh - see the corrected syntax above)
P.S. also thanks to "Gliffy" for the awesome online network diagramming tool :)
metric responded before target; must not be en route