nmap - evading firewalls, IDS, IPS

DNS and DNSSEC Enumeration Using Nmap

DNS Enumeration

Attackers use Nmap for scanning domains and obtaining a list of subdomains, records, IP addresses, and other valuable information from the target host.

List Available Services

Run the following command to list all the available services on the target host:

nmap --script=broadcast-dns-service-discovery <Target Domain>

The above command provides a list of subdomains along with their IP addresses. If any wildcard entries are recorded, they are represented as A for IPv4 addresses and AAAA for IPv6 addresses.

Check DNS Recursion

Run the following command to check whether DNS recursion is enabled on the target server:

nmap -Pn -sU -p 53 --script=dns-recursion 192.168.1.150

DNSSEC Enumeration

DNSSEC provides security for DNS queries and responses. Attackers enumerate DNSSEC using dns-nsec-enum.nse or dns-nsec3-enum.nse NSE scripts to obtain information related to domains and their subdomains.

Execute the following command to retrieve the list of subdomains associated with the target domain:

nmap -sU -p 53 --script dns-nsec-enum --script-args dns-nsec-enum.domains=eccouncil.org <target>

sudo nmap 10.129.2.28 -p 21,22,25 -sS -Pn -n --disable-arp-ping --packet-trace

Nmap's TCP ACK scan (-sA) method is much harder to filter for firewalls and IDS/IPS systems than regular SYN (-sS) or Connect scans (sT) because they only send a TCP packet with only the ACK flag. When a port is closed or open, the host must respond with an RST flag

sudo nmap 10.129.2.28 -p 21,22,25 -sA -Pn -n --disable-arp-ping --packet-trace

Decoys

sudo nmap 10.129.2.28 -p 80 -sS -Pn -n --disable-arp-ping --packet-trace -D RND:5

SYN-Scan of a Filtered Port

sudo nmap 10.129.2.28 -p50000 -sS -Pn -n --disable-arp-ping --packet-trace

SYN-Scan From DNS Port

sudo nmap 10.129.2.28 -p50000 -sS -Pn -n --disable-arp-ping --packet-trace --source-port 53

DNS

nmap -sUVC -p 53,67,123 10.129.101.12 --disable-arp-ping --packet-trace

Test Firewall rules

sudo nmap 10.129.2.28 -n -Pn -p445 -O

Different Source IP

sudo nmap 10.129.2.28 -n -Pn -p 445 -O -S 10.129.2.200 -e tun0

Using netcat to connect to filtered port

ncat -nv --source-port 53 10.129.2.28 50000