Re: Rookie question about differences between -S and -sI option

[Tim <tim-pentest () sentinelchicken org>]

> then I tried to spoof my ip scanning the same target like that :
> nmap -vv -P0 -T4 -S xxx.xxx.xxx.xxx ( spoofed ) -e eth0 xxx.xxx.xxx.50 ( 
> same target as simple scan )  but I obtained every port closed even if nmap 
> scanned clearly the same target as the original trivial scan against 
> xxx.xxx.xxx.50.

Ok, that's a little different.

First, what kind of host are you using as an idle system?  If that
system is a Linux or other recent Unix system, it's likely that they've
eliminated the IP ID information leak.  I know Linux and OpenBSD have
eliminated it, and other BSDs probably have as well.  Only less secure
systems, such as Windows or network devices/printers leak information
about their packet rates.

If you aren't sure what the OS is on the idle system, you could ping it
from two seperate source IPs.  If the IP IDs between the two ping
sequences aren't correlated at all, then you're probably not dealing
with a vulnerable IP implementation.


tim

PS- I think you forgot to CC the list on your last message.  Since this
    may be useful to some, I'll go ahead and post it back.

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner: 

Hackers are concentrating their efforts on attacking applications on your 
website. Up to 75% of cyber attacks are launched on shopping carts, forms, 
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are 
futile against web application hacking. Check your website for vulnerabilities 
to SQL injection, Cross site scripting and other web attacks before hackers do! 
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------