• elhacker.info/Cursos/Advanced Ethical Hacking - Network and Web PenTesting/Part II - Network and Web PenTesting/1. Network Scanning%2C Network Establishment%2C Web Vulnerabilities Exploitation/5.1 Stealth_Idle_Scan.pdf?utm_source=chatgpt.com
• How does idle scan work?

The IDLE/IPID Header Scan is a powerful TCP port scanning method used by attackers to perform complete blind scanning of a remote host by impersonating another computer (known as a "zombie") via IP spoofing.

This scanning technique falls under the category of Third Party and Spoofed TCP Scanning Methods used for Port and Service Discovery.

Mechanism and Purpose

The primary mechanism of the IDLE/IPID Header Scan relies on analyzing the IP Identification (IPID) number of a third-party "zombie" host.

Core Principle (IPID Tracking):

• Every IP packet on the Internet has an IP identification (IPID) that uniquely identifies fragments of an original IP datagram.
• The Operating System (OS) of a host increases the IPID for each packet sent.
• By probing the IPID of the zombie, the attacker can reveal the number of packets the zombie has sent since the last probe.

Blind Scanning:

• This technique allows for the complete blind scanning of a remote host.
• The attacker does not send probe packets from their own IP address; instead, they use a zombie host to scan the remote host.
• If the remote host checks the IP of the scanning party, the IP address displayed will be that of the zombie machine.

Steps of an IDLE Scan

The process of performing an IDLE scan involves three main steps:

Step 1: Identify and Probe the Zombie Host's IPID

1. Choose a Zombie: An appropriate or "idle" zombie incrementally assigns IPID packets on a global basis.
2. Probe the IPID: The attacker sends a SYN+ACK packet to the zombie machine to probe its current IPID number (let's call this value $X$). This packet is sent to probe the IPID, not to establish a TCP connection.
3. Zombie Response: Because the zombie did not expect a SYN+ACK packet (it was unsolicited), it denies the connection by returning an RST packet. The attacker analyzes this RST packet to extract the current IPID number ($X$).

Step 2: Scan the Target Host

1. Spoofed SYN Packet: The attacker sends a SYN packet to a specific port on the target machine (e.g., port 80), but they spoof the source IP address to make it look like it originated from the zombie.
2. Target Response (Open Port): If the port on the target is open, the target sends a SYN+ACK packet back to the zombie (since the IP was spoofed) to proceed with the three-way handshake. The zombie, in turn, sends an RST packet to the target because it did not expect the SYN+ACK. This RST packet is the zombie's first outgoing packet, causing its IPID number to be incremented to $X+1$.
3. Target Response (Closed Port): If the port on the target is closed, the target responds immediately with an RST packet back to the zombie. The zombie remains idle thereafter, meaning its IPID number does not increment.

Step 3: Re-Probe the Zombie Host

1. Second IPID Probe: The attacker follows Step 1 again, sending another SYN+ACK packet to the zombie.
2. Analyze Final IPID: The zombie responds with an RST packet containing its current IPID.
   • If the port on the target was open, the zombie sent one RST packet in Step 2, and one RST packet now, resulting in the IPID being incremented twice. The zombie responds with $X+2$.
   • If the port on the target was closed, the zombie did not send any packets in Step 2, and only sent one RST packet now, resulting in the IPID being incremented once. The zombie responds with $X+1$.

By comparing the initial IPID ($X$) with the final IPID, the attacker can identify the open ports and services on the target machine anonymously.

Nmap Implementation

In Nmap (Network Mapper), the option used to perform an IDLE scan is -sI.

The command syntax used in the sources is nmap -Pn -p- -sI <Zombie> <Target>.

The example output demonstrates the command: #nmap -Pn -p- -sI 10.10.1.11 10.10.1.19. This scan uses the host 10.10.1.11 as the zombie to scan the target host 10.10.1.19.

• The IDLE/IPID header scan is a TCP port scan method that can be used to send a spoofed source address to a computer to determine what services are available
• It offers the complete blind scanning of a remote host
• One way to determine whether a port is open is to send a “SYN” (session establishment) packet to the port
• The target machine returns a “SYN|ACK” (session request acknowledgement) packet if the port is open or an “RST” (reset) packet if the port is closed
• A machine that receives an unsolicited SYN|ACK packet responds with an RST
• An unsolicited RST is ignored
• Every IP packet on the Internet has an “IP identifier” (IPID) that uniquely identifies fragments of an original IP datagram
• The OS increases the IPID for each packet sent
• Probing an IPID reveals to an attacker the number of packets sent since the last probe
• The -sI option is used to perform an IDLE scan.
• The attacker performs this scan by impersonating another computer via spoofing
  • The attacker uses another host called a “zombie,” to scan the remote host and identify open ports
  • the attacker expects the sequence numbers of the zombie host
• If the remote host checks the IP of the scanning party
  • the IP of the zombie machine is displayed

Step 1

• The first step in an idle scan is to determine an appropriate zombie

  • A zombie that incrementally assigns IPID packets on a global basis
  • Idle zombie for performing idle scans

• The shorter the time interval for request/response between the attacker-zombie and zombie-target, the faster is the scan

• Choose a “Zombie” and Probe Its Current IP Identification (IPID) Number In the first step

• the SYN+ACK packet is sent to the zombie machine to probe its IPID number

  • the SYN+ACK packet is not sent to establish a TCP connection (three-way handshake).

• As the zombie does not expect a SYN+ACK packet

  • it denies the connection by returning an RST packet
  • The RST packet sent by the zombie machine is analyzed to extract the IPID

Step 2

• The attacker sends a SYN packet to the target machine on port 80
  • spoofing the IP address of the zombie

If the port is open

• The target(server) sends the SYN+ACK packet to the zombie (as the IP address was spoofed) to proceed with the three-way handshake
• Because the zombie did not expect a SYN+ACK packet from the target machine
  • it responds with an RST packet.

• Every IP packet has an IPID, which increases by one for every packet transmission
• The zombie now uses the next available IPID

If the port is closed

• Upon receiving the SYN packet from the attacker
  • the target responds with an RST packet
  • the zombie remains idle thereafter.

• Attacker sends a SYN+ACK packet to the zombie
  • Zombie responds with an RST packet containing the IPID
• Assuming that the port on the target was open and that the zombie has already sent an RST packet to the target
  • the IPID number is increased by 1
• Now, the zombie responds with an RST packet to the attacker using its next IPID
  • the IPID is increased by 2
  • It implies that the port on the target machine was open

nmap

nmap -Pn -p 80 -sI 10.10.10.20 10.10.10.30