‫So in these end map lectures, we have seen no port scan, also known as ping scan, different ways
‫of scanning ports since scan, also known as half open scanning TCP scan, also known as TCP Connect
‫Scan, UDP, scan service and version detection, operating system detection and end map scripting engine
‫in detail.
‫Now let's see how we can cope with network security devices such as firewalls or packet filtering.
‫You with me?
‫You'll always face some security measures in your penetration test.
‫They will got you.
‫Drop your packets or reply some fake responses.
‫So you have to find those measures and bypass them to go on.
‫Network obstructions such as firewalls can make mapping and network exceedingly difficult.
‫It will not get any easier as stifling casual reconnaissance is often a key goal of implementing the
‫devices.
‫Nevertheless, and MAP offers many features to help understand these complex networks and to verify
‫that the filters are working as intended.
‫It even supports mechanisms for bypassing poorly implemented defenses.
‫One of the best methods of understanding network security posture is to try to defeat it.
‫In addition to restricting network activity, companies are increasingly monitoring traffic with intrusion
‫detection systems or IDs.
‫All of the major indices ship with rules designed to detect and map scans because scans are sometimes
‫a precursor to attacks.
‫Many of these products have recently morphed into intrusion prevention systems, ISPs that actively
‫block traffic deemed malicious, unfortunately for network administrators and its vendors, reliably
‫detecting bad intentions by analyzing packet data.
‫It's a tough problem.
‫Attackers with patience, skill and the help of certain and map options can usually pass by IDs undetected.
‫Meanwhile, administrators must cope with large numbers of false positive results where innocent activities
‫misdiagnosed and alerted on or blocked.
‫So there's no magic bullet for detecting and bypassing firewalls and I.D. systems, it takes skill and
‫experience.
‫So here I'm going to show you a few methods to bypass or detect the IEDs and IPS devices.
‫Although timing techniques are used to improve scan times, they're also very good at being invisible
‫against network security devices such as firewalls or IDs and Ipsus, we'll see the timing techniques
‫in detail, but let's see the other techniques to bypass security measures.
‫The option causes the requested scan to use tiny, fragmented IP packets.
‫The idea here is to split up the TCP header over several packets to make it harder for packet filters,
‫intrusion detection systems and other annoyances to detect what you were doing, specify this option
‫once and and MAP splits the packets into eight bytes or less after the IP header.
‫So a 20 byte TCP header would be split into three packets.
‫So be careful with this.
‫Some programs have trouble handling these tiny packets.
‫Fragmentation is only supported for and maps raw packet features, which includes DCP and UDP port scans
‫and OS detection.
‫Features such as version detection and the unmap scripting engine generally don't support fragmentation
‫because they rely on your host TCP IP stack to communicate with target services.
‫Using well-known ports as a source, part of the package that will send is another technique to bypass
‫firewalls, to trust traffic based only on the source port number is one surprisingly common misconfiguration.
‫It's easy to understand how this comes about.
‫An administrator will set up a shiny new firewall, only to be flooded with complaints from ungrateful
‫users whose applications stopped working.
‫In particular, DNS may be broken because the UDP DNS replies from external servers can no longer enter
‫the network.
‫Here and MAP offers the source port option to exploit this weakness.
‫Simply provide a port number and and map will send packets from that port where possible.
‫Randomise, hosts tell and map to shuffle each group of hosts before it scans them, this can make the
‫scans less obvious to various network monitoring systems, especially when you combine it with slow
‫timing options.
‫You can use the uppercase s to spoof the scan to make the targets think that someone else is scanning
‫them, note that you won't usually receive reply packets back.
‫They will be addressed to the IP you are spoofing.
‫So and MAFF won't produce useful reports.
‫You can also use some techniques to understand the existence of the security measures.
‫The first technique is to analyze the ttle, the time to live values of the incoming packet's.
‫The total values of the packets coming from the destination systems may differ from the total values
‫of the packets coming from a network security device.
‫So find incoming packets which result to different results and analyze their ttle values.
‫Bad, some option asks and map to use an invalid TCP or UDP, some four packets sent to target hosts,
‫since virtually all host IP stacks properly drop these packets, any responses received are likely coming
‫from a firewall, the radius that didn't bother to verify the checksum.