Security Basics mailing list archives
Re: how nmap can know my firewalled servers ?
From: "Arturas Zalenekas" <security () zalenekas net>
Date: Thu, 13 Apr 2006 13:54:08 -0500 (CDT)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just a thought .... :) How does TCP protocol work !? How should it replay, e.g. to a closed port !? With ICMP packet !? No, it has to answer with an RST. So, your service, e.g. telnet, is running on external interface and on localhost (loopback). Set the iptables INPUT chain so, that on the external interface packets will be rejected with RST packets and packets on the loopback interface will be allowed. But I don't really understand the purpose of your test, b/c there are a lot of different techniques to identify, if a service will be protected. It doesn't matter if it a real FW or a router with ACL etc. - -- Kind regards, Arturas Zalenekas Network Security Engineer and Analyst On Thu, April 13, 2006 04:59, Alexey Eremenko wrote:
I am assuming you are using a DROP rule on your firewall. NMAP knows that if it does not receive a response for a TCP connection then it is firewalled. Dropping traffic at a firewall violates RFC and makes it much easier to know when there is a firewall between the scanner and the end host. I recommend using REJECT -A INPUT -j REJECT --reject-with icmp-host-unreachable That will conform to RFC (I'm pretty sure) and will make it harder to detect a firewall with NMAP.True, I am using DROP state on my iptables, but even when I changed the state of my firewall to "REJECT --reject-with icmp-host-unreachable" - nmap _still_ knows that my services are running (telnet) and are filtered ! linux:/ # iptables -A INPUT -p tcp --dport 23 -j REJECT --reject-with icmp-host-unreachable linux:/ # nmap localhost Starting nmap 3.81 ( http://www.insecure.org/nmap/ ) at 2006-04-13 12:59 GMT+2 Interesting ports on localhost (127.0.0.1): (The 1648 ports scanned but not shown below are in state: closed) PORT STATE SERVICE 22/tcp open ssh 23/tcp filtered telnet ... linux:/ # iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination REJECT tcp -- anywhere anywhere tcp dpt:telnet reject-with icmp-host-unreachable Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination So how do I fool nmap that my service is really down ?
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) iD8DBQFEPp5Qh/vuw42ctAARAkFuAKCITbBC8az3NmTXBzDxMy3X6SPbPQCgjONz 3BGGOuC5zuiM5iLNgxOud44= =rji8 -----END PGP SIGNATURE----- ------------------------------------------------------------------------- This List Sponsored by: Webroot Don't leave your confidential company and customer records un-protected. Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no obligation. See why so many companies trust Spy Sweeper Enterprise to eradicate spyware from their networks. FREE 30-Day Trial of Spy Sweeper Enterprise http://www.webroot.com/forms/enterprise_lead.php --------------------------------------------------------------------------
Current thread:
- Re: how nmap can know my firewalled servers ?, (continued)
- Re: how nmap can know my firewalled servers ? Alexey Eremenko (Apr 12)
- Re: how nmap can know my firewalled servers ? Harrison Holland (Apr 12)
- Re: how nmap can know my firewalled servers ? Nathaniel Hall (Apr 12)
- Re: how nmap can know my firewalled servers ? Alice Bryson (Apr 13)
- Re: how nmap can know my firewalled servers ? Arturas Zalenekas (Apr 13)
- Re: how nmap can know my firewalled servers ? Gregory Boyce (Apr 17)
- Re: how nmap can know my firewalled servers ? Arturas Zalenekas (Apr 17)
- Re: how nmap can know my firewalled servers ? Alice Bryson (Apr 13)
- Re: how nmap can know my firewalled servers ? Gregory Boyce (Apr 13)
- Re: how nmap can know my firewalled servers ? Alexey Eremenko (Apr 13)
- Re: how nmap can know my firewalled servers ? manu (Apr 13)
- Re: how nmap can know my firewalled servers ? Arturas Zalenekas (Apr 13)
- Re[2]: how nmap can know my firewalled servers ? Thierry Zoller (Apr 17)
- Re: Re[2]: how nmap can know my firewalled servers ? Arturas Zalenekas (Apr 17)
- Message not available
- Fwd: Re[2]: how nmap can know my firewalled servers ? John Bond (Apr 19)
- Re: Fwd: Re[2]: how nmap can know my firewalled servers ? Ansgar -59cobalt- Wiechers (Apr 21)
- Re: how nmap can know my firewalled servers ? Alexey Eremenko (Apr 13)
- MSN File Upload Monitoring fullsecure (Apr 17)