Bypassing the firewall

is there a way to bypass a firewall to detect the internal network. using tools like nmap and nessus

here is what i get when i try to scan a target that uses a firewall

Starting nmap 3.48 ( http://www.insecure.org/nmap/ ) at 2003-12-26 21:44 EST
Note: Host seems down. If it is really up, but blocking our ping probes, try -P0Nmap run completed -- 1 IP address (0 hosts up) scanned in 16.064 seconds


yet when i ping the target i get this

bash-2.05b# ping 204.118.xxx.xxx
PING 204.118.xxx.xxx (204.118.xxx.xxx) 56(84) bytes of data.
64 bytes from 204.118.xxx.xxx: icmp_seq=5760 ttl=50 time=62.3 ms
64 bytes from 204.118.xxx.xxx: icmp_seq=5761 ttl=50 time=64.3 ms
64 bytes from 204.118.xxx.xxx: icmp_seq=5762 ttl=50 time=62.3 ms
64 bytes from 204.118.xxx.xxx: icmp_seq=5763 ttl=50 time=61.3 ms

How do we know that you are not auditing your computer. You cant have a job because you are under 13. So you dont have many comps to work around. So why do you want to bypass a firewall???

You're under 13 god? Hmm, they start early these days.

Couple of things to look at:

- Can you traceroute to the host? If not what hop does the traceroute die at? Also try a tracert from
a Windows box as it uses ICMP instead of TCP to do the trace. (You can also try 'pathping' if you
have an XP box handy)
- Read the NMAP Docs, there is some really good firewall related scanning material in there.
- Try doing a slower scan (explained in the NMAP Docs), many networks with a good IDS implemented
will just drop your traffic if you are doing anything too agressive.
- If you don't know the network, _always_ assume there is one or more NIDS (possibly on the border routers, and the target gateway).
You can determine for certain the presence of a NIDS later, but these days this assumption is a safe bet.

Just be cool with your scans, a lot of people get pissed about them (for good reason), so keep that in mind.

-- spurious

[Edit] This is a valid security question, and whomever gave god neg's, a piece of coal to you.

thanks spurious_inode, i am not sure about the 13 thing this is not my age, and from where did you get that from leapinglangoor.

Quote:

---

is there a way to bypass a firewall to detect the internal network. using tools like nmap and nessus

here is what i get when i try to scan a target that uses a firewall

---

I think xmaddness says it best

Quote:

---

We are a community that is here to help teach people how to secure their networks, not how to hack into them.

---

These types of questions normally get negged What your asking is pretty much assist you in a malicious act. Hope this helps Computer Nerd22 :)

i am not trying to hack anything, i am just asking is it possible??

I have a problem with the basic idea that if someone asks a question that involves real security as does
this post, the legions of neg-happy hordes all come out of the woods to dish out little red dots. This is total
bullshit. What is it about actual security realted topics, like how to scan through a firewall, etc. that scares
people; this is a security site correct?

Face it folks, real security involves things like firewall testing and other things that go bump in the night.

-- spurious

Look at your profile, it says "AntiOnline Jr. Member" --- You are under 13 if your birth year is above 1990.

I assume you are kidding. If not, please note that 'AntiOnline Jr. Member' is a title in reference to the number of
posts that the member has made. I am 32, and my title is 'AntiOnline Jr. Member' because I have not yet reached
170 posts.

Honest mistake since the the sign-up makes the distiction between >= 13 and <= 13. :)

-- spurious

Birthday 0000-00-00

Now to answer the question...

The reason nmap is reporting the host is down is probably because of the type of ping it's been told to use. By default, nmap when run through nmapfe will ICMP ping the target, but Linux pings use UDP by default. This sounds to me like the host isn't totally firewalled, and does allow certain types of traffic to pass.

so it can be done using a UDP scan with the -sU option

Will you please look at my title and no. of posts.
I just joined a month ago. And please Explain.
May be the problem is that you have chosen the under 13 reg by mistake. Check that out too. Sorry If I have offended anyone.

And back to this topic, Try netscan tools Pro 2000. It has all such scanning utils. Also try Pandora from http://www.nmrc.org. I dunt know how good it is but do try it.

No. UDP port scanning and UDP pings are 2 totally different things. A UDP port scan works like this: A UDP packet is sent to a UDP socket on the remote host. If it doesn't respond, the socket is assumed to be open. If it responds with an unreachable message, the port is considered closed. If every UDP socket seems open, then it's safe to assume the host is silently dropping UDP traffic. So, as you can see, UDP scans are really a bit of a black art and involve educated guesses when firewalls are being used, and this is why they're not used very often.

A UDP ping is similar to a UDP port scan in that your PC sends a UDP packet to the remote host. It then waits for the unreachable message, and this is how the remote host shows up in a standard linux ping.

I agree with spurious_inode with regard to 'security' questions, this is supposed to be a site where we can find out about this sort of subject. Yes, we could read it up, or Google. But the site gets you a real life answer, with any additional probs that might have popped up. And it is possible that someone might make illegal use of their new found knowledge, but it is also possible that if you are aware of security issues, then you will be better placed to resist / stop it in the first place.

As an O/T question, how DO you know that qod got negged for this post. To spurious_inode, as he made reference to this in his first post of the thread?

Quote:

---

Originally posted here by Beryllium9
No. UDP port scanning and UDP pings are 2 totally different things. A UDP port scan works like this: A UDP packet is sent to a UDP socket on the remote host. If it doesn't respond, the socket is assumed to be open. If it responds with an unreachable message, the port is considered closed. If every UDP socket seems open, then it's safe to assume the host is silently dropping UDP traffic. So, as you can see, UDP scans are really a bit of a black art and involve educated guesses when firewalls are being used, and this is why they're not used very often.

A UDP ping is similar to a UDP port scan in that your PC sends a UDP packet to the remote host. It then waits for the unreachable message, and this is how the remote host shows up in a standard linux ping.

---

so how are the 2 different??

btw: i am just trying to scan my network from another location, i do not think it is illegal, and this is my home network that i am scanning.

Quote:

---

Originally posted here by Beryllium9
Now to answer the question...

The reason nmap is reporting the host is down is probably because of the type of ping it's been told to use. By default, nmap when run through nmapfe will ICMP ping the target, but Linux pings use UDP by default. This sounds to me like the host isn't totally firewalled, and does allow certain types of traffic to pass.

---

Beryllium9:

From the ping(8) man page (SuSE 9.0)....

NAME
ping, ping6 - send ICMP ECHO_REQUEST to network hosts

SYNOPSIS
ping [ -LRUbdfnqrvVaAB] [ -c count] [ -i interval] [ -l preload] [ -p pat_
tern] [ -s packetsize] [ -t ttl] [ -w deadline] [ -F flowlabel] [ -I inter_
face] [ -M hint] [ -P policy] [ -Q tos] [ -S sndbuf] [ -T timestamp option]
[ -W timeout] [ hop ...] destination


DESCRIPTION
ping uses the ICMP protocol's mandatory ECHO_REQUEST datagram to elicit an ICMP
ECHO_RESPONSE from a host or gateway. ECHO_REQUEST datagrams (``pings'') have an
IP and ICMP header, followed by a struct timeval and then an arbitrary number of
``pad'' bytes used to fill out the packet.

.......

From the ping(1M) man page (Solairs 8)

NAME
ping - send ICMP (ICMP6) ECHO_REQUEST packets to network
hosts

SYNOPSIS
/usr/sbin/ping host [ timeout ]

/usr/sbin/ping -s [ -l | -U ] [ -adlLnrRv ] [
-A addr_family ] [ -c traffic_class ] [ -g gateway [ -g
gateway ... ] ] [ -F flow_label ] [ -I interval ] [
-i interface ] [ -P tos ] [ -p port ] [ -t ttl ] host [
data_size ] [ count ]

DESCRIPTION
The utility ping utilizes the ICMP (ICMP6 in IPv6)
protocol's ECHO_REQUEST datagram to elicit an ICMP (ICMP6)
ECHO_RESPONSE from the specified host or network gateway. If
host responds, ping will print

...........

From the ping(8) man page (FreeBSD 4.9-RELEASE)

NAME
ping -- send ICMP ECHO_REQUEST packets to network hosts

SYNOPSIS
ping [-AQRadfnqrv] [-c count] [-i wait] [-l preload] [-m ttl]
[-p pattern] [-P policy] [-s packetsize] [-S src_addr] [-t timeout]
[host | [-L] [-I interface] [-T ttl] mcast-group]

DESCRIPTION
Ping uses the ICMP protocol's mandatory ECHO_REQUEST datagram to elicit
an ICMP ECHO_RESPONSE from a host or gateway. ECHO_REQUEST datagrams
(``pings'') have an IP and ICMP header, followed by a ``struct timeval''
and then an arbitrary number of ``pad'' bytes used to fill out the
packet. The options are as follows:


Hmmmmm. You may have read something, or have other reason to believe that Linux sends UDP pings,
howerver I would have to politely disagree. Ping is an ICMP (Internet Control Message Protocol) utility
on any OS I can think of .

-- spurious

Quote:

---

Originally posted here by foxyloxley
I agree with spurious_inode with regard to 'security' questions, this is supposed to be a site where we can find out about this sort of subject. Yes, we could read it up, or Google. But the site gets you a real life answer, with any additional probs that might have popped up. And it is possible that someone might make illegal use of their new found knowledge, but it is also possible that if you are aware of security issues, then you will be better placed to resist / stop it in the first place.

As an O/T question, how DO you know that qod got negged for this post. To spurious_inode, as he made reference to this in his first post of the thread?

---

foxyloxley: This post started out with god having been neg'd. Enough people must have seen the error
and given god some positive AP's to even him out.

i think Beryllium9 was trying to say that UDP ping is just doing a ping ip_address which is mostly used in ping sweeps to detect if a machine is alive.
which is better documented in the man nmap:

-sP Ping scanning: Sometimes you only want to know
which hosts on a network are up. Nmap can do this
by sending ICMP echo request packets to every IP
address on the networks you specify. Hosts that
respond are up. Unfortunately, some sites such as
microsoft.com block echo request packets. Thus
nmap can also send a TCP ack packet to (by default)
port 80. If we get an RST back, that machine is
up. A third technique involves sending a SYN
packet and waiting for a RST or a SYN/ACK. For
non-root users, a connect() method is used.

By default (for root users), nmap uses both the
ICMP and ACK techniques in parallel. You can
change the -P option described later.

Note that pinging is done by default anyway, and
only hosts that respond are scanned. Only use this
option if you wish to ping sweep without doing any
actual port scans.



while UDP scanning is
from man namp:

-sU UDP scans: This method is used to determine which
UDP (User Datagram Protocol, RFC 768) ports are
open on a host. The technique is to send 0 byte
UDP packets to each port on the target machine. If
we receive an ICMP port unreachable message, then
the port is closed. Otherwise we assume it is
open. Unfortunately, firewalls often block the
port unreachable messages, causing the port to
appear open. Sometimes an ISP will block only a
few specific dangerous ports such as 31337 (back
orifice) and 139 (Windows NetBIOS), making it look
like these vulnerable ports are open. So don't
panic immediately. Unfortunately, it isn't always
trivial to differentiate between real open UDP
ports and these filtered false-positives.

Some people think UDP scanning is pointless. I usu_
ally remind them of the recent Solaris rcpbind
hole. Rpcbind can be found hiding on an undocu_
mented UDP port somewhere above 32770. So it
doesn't matter that 111 is blocked by the firewall.
But can you find which of the more than 30,000 high
ports it is listening on? With a UDP scanner you
can! There is also the cDc Back Orifice backdoor
program which hides on a configurable UDP port on
Windows machines. Not to mention the many commonly
vulnerable services that utilize UDP such as snmp,
tftp, NFS, etc.

Unfortunately UDP scanning is sometimes painfully
slow since most hosts implement a suggestion in RFC
1812 (section 4.3.2.8) of limiting the ICMP error
message rate. For example, the Linux kernel (in
net/ipv4/icmp.h) limits destination unreachable
message generation to 80 per 4 seconds, with a 1/4
second penalty if that is exceeded. Solaris has
much more strict limits (about 2 messages per sec_
ond) and thus takes even longer to scan. nmap
detects this rate limiting and slows down accord_
ingly, rather than flood the network with useless
packets that will be ignored by the target machine.

As is typical, Microsoft ignored the suggestion of
the RFC and does not seem to do any rate limiting
at all on Win95 and NT machines. Thus we can scan
all 65K ports of a Windows machine very quickly.
Whoop!

Quote:

---

Originally posted here by Beryllium9
No. UDP port scanning and UDP pings are 2 totally different things. A UDP port scan works like this: A UDP packet is sent to a UDP socket on the remote host. If it doesn't respond, the socket is assumed to be open. If it responds with an unreachable message, the port is considered closed. If every UDP socket seems open, then it's safe to assume the host is silently dropping UDP traffic. So, as you can see, UDP scans are really a bit of a black art and involve educated guesses when firewalls are being used, and this is why they're not used very often.

A UDP ping is similar to a UDP port scan in that your PC sends a UDP packet to the remote host. It then waits for the unreachable message, and this is how the remote host shows up in a standard linux ping.

---

god / Beryllium9:

[..... and this is how the remote host shows up in a standard linux ping.]

I may have misunderstood what Beryllium9 was saying in reference to what protocol Linux uses as the default
for ping. Apologies Beryllium9, no ball-busting intended.... :)

-- spurious

i belive all pings use the ICMP_ECHO packets to detect if a system is up.



btw. it is QoD and not GOD

:)

And all this time I thought I was talking firewalls and hacking with the `Almighty One'.....

Sorry QoD, you must have been wondering why this doomaas spurious person can't get your name right. :)

Guys, does it really matter about the age?

I was working with the SysAdmin and the Tech while i was at school, when i was 14. I worked with them throughout most of my school life on a network of 400+ computers, and since i worked with them so long, they gave me root.

And working with education, there are many firewalls and proxies, as most work know, and sometimes you have to try and bypass them to get stuff working like :- DisEd, Remote Edu Access etc.

So obviously you dont have to be working to know about this stuff, just look at me. Newho, reactions might suggest 'leapinglangoor' first post is right, however have a think and spare a though and look at all the possibilities before questioning people.

Thanks for reading and hopeful all AO'ers take this thought into consideration,

Search term "firewalk"

Nota Bene : I am contributing to this thread because it's important to understand the oppositions methods in order to secure or protect your network.

Krang

Yep, don't even need the search... jump to http://www.packetfactory.net/firewalk/

Quote:

---

Originally posted here by qod
i am not trying to hack anything, i am just asking is it possible??

---

It depends on the type of firewall, configuration, intruder's skills etc.
For example, it's possible to enumerate host behind a simple (non-stateful) firewall with ACK tcp packets using tools like hping2.
Some times it happens to find a hole through the firewall, because of a wrong configuration etc.

But the most common way I think is to compromise a host in the DMZ (ex. a web server) and then you've got the internal net at your disposal ;)

Oops, you're right, I made a mistake. Was thinking about the traceroute utility using UDP by default. :) Still, traceroute is similar to ping in that it waits for unreachable messages, just a little smarter in that the packets sent start with a TTL of 1, then the TTL is incremented until it reaches the destination IP.

What I should've said was nmap defaults to TCP pings for non-root users, and if the host is firewalled, these packets will be discarded. It seems the host does allow ICMP traffic through though if it shows up using the ping command. There are some rootkits that use ICMP to pass commands, or cause the compromised machine to connect back to the attackers machine, thereby bypassing the firewall. This only works if the outbound firewall rules are weak enough though....

Quote:

---

Originally posted here by Beryllium9
Oops, you're right, I made a mistake. Was thinking about the traceroute utility using UDP by default. :) Still, traceroute is similar to ping in that it waits for unreachable messages, just a little smarter in that the packets sent start with a TTL of 1, then the TTL is incremented until it reaches the destination IP.

---

traceroute uses ICMP_ECHO packets by default which uses UDP. But traceroute are no UDP packets but ICMP packets.


btw i am glad how this thread turned out, people were bashing it and now every one is helping.

Nope, traceroute under linux uses UDP by default. To make it use ICMP echo requests instead, you have to use the -I option on the command line. From the man pages:-

-I Use ICMP ECHO instead of UDP datagrams.

i never knew that, thanks Beryllium9

I've been deprived of the net for a while, and this thread was a nice morning read. I, too, did not know that Linux used UDP for it's traceroute... Every day is good when you learn something new.

Quote:

---

Originally posted here by Sunflare
... Every day is good when you learn something new.

---

Sure ;)

And there's even more. Try to learn using tools like hping2 - you'll find some features to trace even behind some firewalls.

one more question, if you use traceroute without ICMP_ECHO what does it use to do the UDP scan does still use the ICMP without the ECHO??

It does it by setting the TTL field on the UDP packet it sends out. As packets travel to their destination, every router it passes through decrements the TTL field by 1. Once the TTL gets to 0, the packet is dropped and a destination unreachable message (ICMP type 3) is returned to the sender. This is to prevent networks getting congested by traffic stuck in a routing loop.

Traceroute exploits this by sending UDP packets with customised TTL fields. The first packet it sends has a TTL of 1, the second has a TTL of 2, etc. until it gets the first proper reply from the target. The unreachable messages generated have the IP address of the sender in the packet header, and this is how traceroute determines the addresses of any routers. Latency is determined by timing the wait between the packet being sent, and the unreachable message being returned.

In order for traceroute to be able to do this, it has to have the ability to create raw packets, which is why it's a suid root program. If it didn't have the sticky bit set, it wouldn't work because it won't be able to send any custom packets.