Return to SPOOFED_SCAN.txt CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / hping2 / docs

Annotation of embedaddon/hping2/docs/SPOOFED_SCAN.txt, revision 1.1

1.1     ! misho       1: The following is the original posting to bugtraq
        !             2: about spoofed/indirect/idle scan method. See
        !             3: the HPING2-HOWTO for more informations.
        !             4: 
        !             5: antirez
        !             6: 
        !             7: ---
        !             8: 
        !             9:   Hi,
        !            10: 
        !            11:         I have uncovered a new tcp port scan method.
        !            12:         Instead all others it allows you to scan using spoofed
        !            13:         packets, so scanned hosts can't see your real address.
        !            14:         In order to perform this i use three well known tcp/ip
        !            15:         implementation peculiarities of most OS:
        !            16: 
        !            17:           (1) * hosts reply SYN|ACK to SYN if tcp target port is open,
        !            18:             reply RST|ACK if tcp target port is closed.
        !            19: 
        !            20:           (2) * You can know the number of packets that hosts are sending
        !            21:             using id ip header field. See my previous posting 'about the ip
        !            22:             header' in this ml.
        !            23: 
        !            24:           (3) * hosts reply RST to SYN|ACK, reply nothing to RST.
        !            25: 
        !            26: 
        !            27:         The Players:
        !            28: 
        !            29:           host A - evil host, the attacker.
        !            30:           host B - silent host.
        !            31:           host C - victim host.
        !            32: 
        !            33:         A is your host.
        !            34:         B is a particular host: It must not send any packets while
        !            35:           you are scanning C. There are a lot of 'zero traffic' hosts
        !            36:           in internet, especially in the night :)
        !            37:         C is the victim, it must be vulnerable to SYN scan.
        !            38: 
        !            39:         I've called this scan method 'dumb host scan' in honour of host
        !            40:         B characteristics.
        !            41: 
        !            42: 
        !            43:         How it works:
        !            44: 
        !            45:         Host A monitors number of outgoing packets from B using id iphdr.
        !            46:         You can do this simply using hping:
        !            47: 
        !            48: #hping B -r
        !            49: HPING B (eth0 xxx.yyy.zzz.jjj): no flags are set, 40 data bytes
        !            50: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=0 ttl=64 id=41660 win=0 time=1.2 ms
        !            51: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=1 ttl=64 id=+1 win=0 time=75 ms
        !            52: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=2 ttl=64 id=+1 win=0 time=91 ms
        !            53: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=3 ttl=64 id=+1 win=0 time=90 ms
        !            54: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=4 ttl=64 id=+1 win=0 time=91 ms
        !            55: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=5 ttl=64 id=+1 win=0 time=87 ms
        !            56: -cut-
        !            57: ..
        !            58: .
        !            59: 
        !            60:         As you can see, id increases are always 1. So this host have the
        !            61:         characteristics that host B should to own.
        !            62: 
        !            63:         Now host A sends SYN to port X of C spoofing from B.
        !            64:         (using hping => 0.67 is very easy, http://www.kyuzz.org/antirez)
        !            65:         if port X of C is open, host C will send SYN|ACK to B (yes,
        !            66:         host C don't know that the real sender is A). In this
        !            67:         case host B replies to SYN|ACK with a RST.
        !            68:         If we send to host C a few of SYN it will reply to B with a few
        !            69:         of SYN|ACK, so B will reply to C a few of RST... so
        !            70:         we'll see that host B is sending packets!
        !            71: 
        !            72: .
        !            73: ..
        !            74: -cut-
        !            75: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=17 ttl=64 id=+1 win=0 time=96 ms
        !            76: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=18 ttl=64 id=+1 win=0 time=80 ms
        !            77: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=19 ttl=64 id=+2 win=0 time=83 ms
        !            78: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=20 ttl=64 id=+3 win=0 time=94 ms
        !            79: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=21 ttl=64 id=+1 win=0 time=92 ms
        !            80: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=22 ttl=64 id=+2 win=0 time=82 ms
        !            81: -cut-
        !            82: ..
        !            83: .
        !            84: 
        !            85:         The port is open!
        !            86: 
        !            87:         Instead, if port X of C is closed sending to C a few
        !            88:         of SYN spoofed from B, it will reply with RST to B, and
        !            89:         B will not reply (see 3). So we'll see that host B is not sending
        !            90:         any packet:
        !            91: 
        !            92: .
        !            93: ..
        !            94: -cut-
        !            95: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=52 ttl=64 id=+1 win=0 time=85 ms
        !            96: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=53 ttl=64 id=+1 win=0 time=83 ms
        !            97: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=54 ttl=64 id=+1 win=0 time=93 ms
        !            98: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=55 ttl=64 id=+1 win=0 time=74 ms
        !            99: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=56 ttl=64 id=+1 win=0 time=95 ms
        !           100: 60 bytes from xxx.yyy.zzz.jjj: flags=RA seq=57 ttl=64 id=+1 win=0 time=81 ms
        !           101: -cut-
        !           102: ..
        !           103: .
        !           104: 
        !           105:         The port is closed.
        !           106: 
        !           107:         All this can appear complicated to perform, but using two sessions
        !           108:         of hping on Linux virtual consoles or under X makes it more simple.
        !           109:         First session listen host B: hping B -r
        !           110:         Second session send spoofed SYN: hping C -a B -S
        !           111: 
        !           112:         Sorry if my english is not so clear.
        !           113:         However this posting is not adequate to describe exaustively
        !           114:         this scan method, so i'll write a paper on this topic, specially
        !           115:         about how to implement this in a port scanner (i.e. nmap), and
        !           116:         about players characteristics and OS used.
        !           117: 
        !           118: happy new year,
        !           119: antirez