How can I scan open ports through Windows Firewall?

Question

I use Kali Linux and VMWare for testing some penetration techniques. The problem is that when I scan ports with Nmap to my Windows IP "all ports are filtered". I know that the firewall is blocking the Nmap test. My question is: how can I scan open ports with Nmap even it there is a firewall?

Answer 1

A port scanner, like nmap, connects to a port and analyzes the traffic being returned. A firewall's most basic function is to block access to a port. This means that there is no way to scan a port that is being blocked by a firewall. With some exceptions...

Some firewalls will allow traffic to a port unless it determines that the traffic is malicious (like a port scanner) and then it blocks the port. Sometimes reducing the speed of the scan can help, sometimes scanning the most probable ports first (80, 443) can work in case the firewall is designed to block IPs that scan blocked ports. Some firewalls can inspect the packet characteristics in order to determine that the packet came from a port scanner (each one has a fingerprint). So, in order to bypass these types of protections, you would need to play with the scanner settings, try different scanners, connect to expected ports with a valid client (browser to port 80), or build your own tool. But in all(?) cases, if the firewall is configured to block traffic to a port, then you cannot communicate with the port.

That said, Windows Firewall does not have any of the above protections. It blocks traffic to ports.

Answer 2

You can try to use something as the -T2 option to slow down the scan since many firewall drop packets sent too fast. There's a list of option that can help you with IDS\firewall evasion: https://nmap.org/book/man-bypass-firewalls-ids.html

Answer 3

A firewall only protects against direct scanning from outside. If you set up a web server and manage to get some user inside the firewall to visit your site you can use this to do limited scans from inside with the help of the browser and some Javascript. See https://defuse.ca/in-browser-port-scanning.htm for an example or search for more examples.

Note that this is only a limited scan compared to nmap and of course you can still not connect to these ports from outside. But it might be helpful to detect what's inside the firewall and you could find intranet servers this way and later try to attack them from outside with CSRF or similar cross-site attacks.