Firewall / IDS Evasion and Spoofing

Question 1

Requested scan (including ping scans) use tiny fragmented IP packets. Harder for packet filters

Answer 1

-f

nmap 192.168.1.1 -f

Question 2

Set your own offset size

Answer 2

–mtu

nmap 192.168.1.1 –mtu 32

Question 3

Send scans from spoofed IPs

Answer 3

-D

nmap -D 192.168.1.101,192.168.1.102,
192.168.1.103,192.168.1.23 192.168.1.1

Explained:
nmap -D decoy-ip1,decoy-ip2,your-own-ip,decoy-ip3,decoy-ip4 remote-host-ip

Question 4

Scan Facebook from Microsoft (-e eth0 -Pn may be required)

Answer 4

-S

nmap -S www.microsoft.com www.facebook.com

Question 5

Use given source port number

Answer 5

-g

nmap -g 53 192.168.1.1

Question 6

Relay connections through HTTP/SOCKS4 proxies

Answer 6

–proxies

nmap –proxies http://192.168.1.1:8080, http://192.168.1.2:8080 192.168.1.1

Question 7

Appends random data to sent packets

Answer 7

–data-length

nmap –data-length 200 192.168.1.1

Question 8

Example IDS Evasion command

Answer 8

nmap -f -t 0 -n -Pn –data-length 200 -D 192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23 192.168.1.1