Firewall evasion with Nmap

of bob218

Image of bob218

What is a Firewall? A firewall is software or hardware used to protect the private network from the public network. If hackers scan the network, these methods are discarded by the firewall.

Nmap options to bypass the firewall:

-f (fragment packets) > The purpose of this option is to make packet detection more difficult. With this option Nmap will split the packet into 8 bytes or less after the IP header.

–mtu > With this option, you can specify your own packet size fragmentation. The maximum transmission unit (MTU) must be a multiple of eight or Nmap will give an error.

nmap -mtu 16 131.108.232.99

-D (decoy) > Using this option, Nmap will send some of the probes from the fake IP addresses specified by the user. The idea is to mask the user’s real IP address in the log files. You can use RND to generate a random IP address or RND:number to generate the IP address <number>. The hosts you use for the decoys should be active, otherwise you will flood the target. Also remember that using many decoys can cause network congestion.

–source-port <portnumber > or –g (spoof source port) > This option will be useful if the firewall is set up to allow all incoming traffic that comes from a specific port.