Nmap Scanning & Firewall Bypas

Discovering hosts from the outside

1. TLS/SSL Service Recognition via Nmap

$ nmap -sV --reason -PN -n --top-ports 100 www.example.com

2. Checking for Certificate Information, Weak Ciphers and SSLv2 via Nmap

$ nmap --script ssl-cert,ssl-enum-ciphers -p 443,465,993,995 www.example.com

3. Checking for Client-Initiated Renegotiation and Secure Renegotiation Via OpenSSL (Manually)

 openssl s_client -connect www2.example.com:443

4. Testing Supported Cipher Suites, BEAST and CRIME Attacks via TestSSLServer

java -jar TestSSLServer.jar www3.example.com 443

Testing SSL/TLS Vulnerabilities with sslyze

sslyze is a python script which permits mass scanning and XML output. The following is an example of a regular scan. It is one of the most complete and versatile tools for SSL/TLS testing.

$ ./sslyze.py --regular example.com:443

6. Testing SSL/TLS with testssl.sh

Testssl.sh is a Linux shell script which provides clear output to facilitate good decision making. It can not only check web servers but also services on other ports, supports STARTTLS, SNI, SPDY and does a few check on the HTTP header as well.

It’s a very easy to use tool. Here’s some sample output (without colors):

$ testssl.sh owasp.org

7. Testing SSL/TLS with SSL Breacher

SSL Breacher is combination of several other tools plus some additional checks in complementing most comprehensive SSL tests. It supports the following checks:

1. HeartBleed

2. ChangeCipherSpec Injection

3. BREACH

4. BEAST

5. Forward Secrecy support

6. RC4 support

7. CRIME & TIME (If CRIME is detected, TIME will also be reported)

8. Lucky13

9. HSTS: Check for implementation of HSTS header

10. HSTS: Reasonable duration of MAX-AGE

11. HSTS: Check for SubDomains support

12. Certificate expiration

13. Insufficient public key-length

14. Host-name mismatch

15. Weak/Insecure Hashing Algorithm (MD2, MD4, MD5, SHA1)

16. SSLv2 support

17. Weak ciphers check (Low, Anon, Null, Export)

18. Null Prefix in certificate

19. HTTPS Stripping

20. Surf Jacking

21. Non-SSL elements/contents embedded in SSL page

22. Cache-Control

$ breacher.sh https://localhost/login.php

ICMP

This is the easiest and fastest way to discover if a host is up or not. You could try to send some ICMP packets and expect responses. The easiest way is just sending an echo request and expect from the response. You can do that using a simple pingor using fpingfor ranges. You could also use nmap to send other types of ICMP packets (this will avoid filters to common ICMP echo request-response).

ping -c 1 199.66.11.4    # 1 echo request to a host
fping -g 199.66.11.0/24  # Send echo requests to ranges
nmap -PE -PM -PP -sn -n 199.66.11.0/24 #Send echo, timestamp requests and subnet mask requ

TCP Port Discovery

It's very common to find that all kind of ICMP packets are being filtered. Then, all you can do to check if a host is up is try to find open ports. Each host has 65535 ports, so, if you have a "big" scope you cannot test if each port of each host is open or not, that will take too much time. Then, what you need is a fast port scanner (masscan) and a list of the ports more used:

Copy

#Using masscan to scan top20ports of nmap in a /24 range (less than 5min)
masscan -p20,21-23,25,53,80,110,111,135,139,143,443,445,993,995,1723,3306,3389,5900,8080 199.66.11.0/24

You could also perform this step with nmap, but it slower and somewhat nmaphas problems identifying hosts up.

HTTP Port Discovery

This is just a TCP port discovery useful when you want to focus on discovering HTTPservices:

Copy

masscan -p80,443,8000-8100,8443 199.66.11.0/24

UDP Port Discovery

You could also try to check for some UDP port open to decide if you should pay more attention to a host. As UDP services usually don't respond with any data to a regular empty UDP probe packet it is difficult to say if a port is being filtered or open. The easiest way to decide this is to send a packet related to the running service, and as you don't know which service is running, you should try the most probable based on the port number:

Copy

nmap -sU -sV --version-intensity 0 -F -n 199.66.11.53/24
# The -sV will make nmap test each possible known UDP service packet
# The "--version-intensity 0" will make nmap only test the most probable

The nmap line proposed before will test the top 1000 UDP ports in every host inside the /24 range but even only this will take \>20min. If need fastest results you can use udp-proto-scanner: ./udp-proto-scanner.pl 199.66.11.53/24 This will send these UDP probes to their expected port (for a /24 range this will just take 1 min): DNSStatusRequest, DNSVersionBindReq, NBTStat, NTPRequest, RPCCheck, SNMPv3GetRequest, chargen, citrix, daytime, db2, echo, gtpv1, ike,ms-sql, ms-sql-slam, netop, ntp, rpc, snmp-public, systat, tftp, time, xdmcp.

SCTP Port Discovery

Copy

#Probably useless, but it's pretty fast, why not trying?
nmap -T4 -sY -n --open -Pn <IP/range>