stealth scanning ... what is it good for?

yes i do know why should you use it and i know that it is harder to detect, but ask yourself... why would you try to use all the different stealth scans, why would you try to increment packets w/ delay, why would you use it if it's not as reliable as connect scan... if all you can do is go to nearest library or cyber-cafe and run full scan from there and noone will will be ever able to know your real IP or identity ...

seriously... what are the uses? one that i can think of is if the IDS is set up to drop packets or fake services when it detects a port scan, but if they already went to all the trouble to set that up, they sould be able to detect stealth/fin/.... scans too.

ideas..?

Using different settings in a scan can be used to determine how a perimeter firewall(or any other target) handles different packets and can often identify the type of hardware or software being used along with its rules. This can lead to exposing information which can be used later in an attack (or how to attack un-noticed). Someone who knows exactly what they are looking for may only need to send a few packets here and there and may not really be concerned with mapping all the ports. This is when sending a shitstorm of packets is not in the attackers interest. Besides a stealth scan might be noticed yes, but a normal scan definitely will. Attackers like the element of surprise.
-Maestr0

point taken ... what i'm trying to say is that it is trivial for almost anyone to access another machine and do any footpringting from there...

so the different types of scans are really used to see how the network behaves ?

In addition to the element of surprise (which should not be taken lightly), there's the issue of convenience. Scanning a network can take a long time, even if you're going at aggressive speeds. If there's not a whole lot of time pressure, you can just set up a paranoid scan and let it run for a couple weeks. No standing out in a public park in the rain, holding an umbrella over your laptop. No shatter attacks on the library computers trying to get r00t, etc.

There are a few reasons you would consider using stealth scans (for example syn).

1) You don't have to bother settting up the full connection (looks for either syn-ack or rst as reply and moves on), so it is faster.

2) Your connection will usually not show up in the system log of the machine scanned (since you never completed the connection), with the exception of the system running some kind HIDS like psionic portsentry.

3) When combined with other methods, slowing scan rate, randomizing ports, fragmenting packets, and spoofing source, it can be very hard to track down who the real culprit is, TCP connection scans are a dead giveaway from the Network level down to the Host level.

4) Fin scans at times can bypass inadequate firewall protection (non-stateful firewalls), because it will be treated like part of an existing conversation, kind of the same as setting the source port of the scan as 53, which will confuse older firewalls..


/nebulus

Scanning for a small set of ports, as well as having a large time gap between scans is also a measure to avoid being blocked by IDS. The idea is being stealth, isnt it? You may need some more effort to get info, but you make sure it wont bring much attention.
A small number of connections to a few ports from different locations and at different periods sounds like a better measure than using fake packets, that might easily be spot as such. But sure, It doesn't resume all situations, so I stand that stealth scan has its uses.

The original question was why would you bother being stealth at all, as opposed to just scanning from a public terminal/open hotspot/etc.

And any admin that automatically blocks IPs when they detect a port scan is silly. Instant DOS attack - just forge some packets!

"kind of the same as setting the source port of the scan as 53, which will confuse older firewalls.. "

can you explain... why is that???

also since we are on the subject, does anyone know why sometimes syn scan can discover more sockets open than connect???

wow very interesting, i did not know that about syn scans, but recently i have not been able to get Nmap to connect to anything even my self! wish i knew why that was. but, great post nebulus, ya learn somethin new everyday!:D

Quote:

---

Originally posted here by Alphaflux
wow very interesting, i did not know that about syn scans, but recently i have not been able to get Nmap to connect to anything even my self! wish i knew why that was. but, great post nebulus, ya learn somethin new everyday!:D

---

I had the same problem once. Try using less options. My problem was that I was pinging the hosts and they weren't responding, maybe that is your problem too. Also try not resolving hostnames.

It's a lot like steath bombing really.....

If you can get away with your life..... why not?

When you initiate a connection out, say to a web server (port 80), your client sets a port for the local side (usually > 1024). Older firewalls and less sophisticated firewalls, only looked at source and destination ports to keep track of the state of connections via ACL's. So if it saw a connection with a source port < 1024 (and that port was allowed in), it would assume it was a reply to an already established connection, and allow it to pass.

So what you could do to bypass the types of firewalls was set your source port to say 25 (smtp) and port scan through the firewall because the firewall would think that all of your packets were reply packets instead of connection requests. While this isn't the case any longer with firewalls, you can still slip into alot of networks masquerading as dns, smtp, http, etc because of poorly created ACL's...


Hmm...now that I am reading that I am not so sure I made much sense...

Let me know, I might have to try again...

As far as finding more sockets, if you can bypass the firewall...guess what? ;)

/nebulus

What if you were just scanning for web servers(port 80), could you make it to where it is like any normal request to the server, or do the scanners sort of have a, how do I say this, defining characteristic that makes it not seem to be a normal request? I guess I already know the answer to that which is they do sort of set off an alarm on the other side, I guess my real question is can you make it like any other request so it looks like you just want the web page? I ask because sometimes I like to scan for web servers run from residential areas, like mine is, just to see what they are serving. I have a web server with no domain name so it can only be reached with my ip and DNS from my isp(i don't know if the part about DNS is right). Would any of you frown on a scan on port 80(besides you Tiger Shark, I'd probably end up dead if I accidentally scanned your IP)?

Restating what nebulus200 said:
The way TCP servers work is thus:
The server has a well-known port upon which is runs. So port 80, for example. When you connect to the server on port 80, it then establishes back a connection to you on another port. This back connection is on a port number above 1024. ASCII art:

Code:

---

Server      Client
  |<--- 80 ----|
  |            |
  |-- 1025+ -->|
  |            |

---

Now, cool firewalls keep track of connections, so they know that the connection from the server to the client on port 2841 was a response to the connection from the client to the server on port 80. This is known as stateful inspection.

Older firewalls were stupid. The typical way they were configured was to allow any traffic at all over any port with a number greater than 1024. Otherwise, you couldn't connect to servers outside the firewall. So if you try to connect from port 25 on your machine to a high port on the victim machine, the firewall just thinks that the victim machine is sending email.

Answering h3r3tic's question:
The problem with just sending a "GET / HTTP/1.0" to port 80 of every IP address is that the firewall/IDS knows that you're not supposed to be connecting to port 80 of most of those IPs. So your scan is going to ring a lot more bells than if you were doing syn attempts, which some firewalls/IDSs won't notice.