Nmap: More port scanning techniques

This is the fifth in a series of tips on how to use Nmap in an enterprise network environment.

In our last tip we looked at the basic Nmap commands for scanning network machines and services. In this tip I want to look at some of the scans that exploit certain idiosyncrasies of specific platforms or protocols in order to better differentiate between open and closed ports.

Nmap's TCP Null (option –sN), FIN (option –sF) and Xmas (option –sX) scans exploit a subtle loophole in the TCP protocol specification as described in RFC 793. When scanning systems compliant with this RFC (such as most Unix-based systems), any packet not containing set SYN, RST or ACK bits will result in a returned RST (reset) packet if the port is closed, and no response at all if the port is open. If a RST packet is received, the port is considered closed, while no response means it is open or possibly filtered. The key advantage to these scans is that they can pass through certain non-stateful firewalls and packet-filtering routers.

Another scan that can bypass packet filters in certain circumstances is the IPID Idle scan (option -sI). By using another device on the network, commonly called a zombie, Nmap's Idlescan can gather port information from a remote device without having to send it a single packet from its own IP address. Any intrusion detection system (IDS) will report the innocent zombie as the attacker but of more importance is that this scan can be used to map out IP-based trust relationships

More on Nmap Read our previous tip on using Nmap to scan ports and services. Learn how to install Nmap on Linux or Windows. Learn why Nmap is a valuable tool for security practitioners.

between machines, because the Idlescan results show open ports from the zombie machine's perspective. So for example, a normal scan against a database server might show no ports open, but by using a file server IP as the zombie the database-related service ports on the database server may show open and expose a trust relationship. If by using Nmap to explore your network you realize that it's susceptible to IPID-related attacks, then you need to configure or adjust your firewall and router rules to deny incoming packets with bogus source addresses. Also, you should enable egress filtering to prevent spoofed packets from leaving your network to prevent your internal users from launching this type of attack.

Nmap provides another scan, the TCP ACK scan (option -sA), to help map out firewall rule sets. This scan doesn't determine whether a port is open or closed, but it can tell if it's filtered and whether the device filtering the port is stateful or not. We will look at firewall evasion in the next tip, but in the meantime, you can experiment probing and analysing your firewalls and network by sending a variety of probe types with different flag settings. Even though Nmap includes several different scans, you can design your own scan by specifying arbitrary TCP flags using the Custom TCP scan (option --scanflags). For example, you can run a SYN|FIN scan with the command

NMAP TECHNICAL MANUAL

  Introduction
  Nmap: A valuable open source tool for network security
  How to install and configure Nmap for Windows
  How to install and configure Nmap on Linux
  How to scan ports and services
 More port scanning techniques
  Firewall configuration testing
  Techniques for improving Nmap scan times
  Interpreting and acting on Nmap scan results
  Nmap parsers and interfaces
  Nmap and the open source debate