Re: [PEN-TEST] Firewalking

[Enno Rey <erey () IX URZ UNI-HEIDELBERG DE>]

Hi,

can you reach systems protected by the fw, e.g. servers in a DMZ?
Try to traceroute those systems (from a windows system, as UDP packets used
by Unix traceroute probably will be blocked) or firewalk them
(www.packetfactory.net/Projects/Firewalk/). Then you'll get packets
generated from the fw itself which you can analyze. Have a look at the
params of those packets e.g. the ttl [unix: 255-(number of hops) vs.
windows: (128-nr. hops)] and others (to be found on paper on ICMP usage for
scanning www.sys-security.com/html/papers.html).

You could also try different DoS which affect different OSs (jolt2,
bubonic.c etc.), though some work only on local subnets and furthermore this
may outside the scope of your test ;-))

Regards,

Enno Rey

erey () security-academy de --- www.security-academy.de
PGP 74C0 C7E1 3875 E4EB 9B75  8B9D 5E2D 3178 685B F222