Instructor: We mentioned fragmented packets
and creating decoys in the previous video.
Right now we are going to mention a few more options
and even though they are not that important,
it is good to know they exist
so let's go through them real fast.
I will not be running these options
but you can test them out if you want.
I will just mention them so you know what else you can use.
The first thing we got is option dash S,
and you run it like this, Sudo NMAP dash S,
and this option is used to spoof your IP address.
It will make your target think that someone else
is scanning them.
The problem with this is that you will not get results
of scanned back since they will be sent
to the IP address that you're trying to impersonate.
So for example,
you can be trying to impersonate 8.8.8.8
and your target will be scanned with this IP address
or at least it will seem that the scan
is coming from this IP address.
For this option to work, you must also specify dash Pn.
And the reason why you must specify dash Pn
is first of all, dash Pn is used to assume
that all hosts are online.
So it doesn't perform the ping scan to discover
whether a host is up and running.
Without the dash Pn, this option would not work,
and the reason is because your target
will be scanned with this IP address.
And we will not be able to get the packets back
and see whether the target is on or off.
That's why we will just assume that the target is online
so we can scan them with a different IP address.
Otherwise, we will never get the result
whether they are online.
And sometimes with these two options
you must also run dash E.
E is used to specify a network interface.
So you would simply just type, ifconfig,
check out what network interface you're using,
and you would specify it right here.
In my case, that would be ETH0.
Another cool option besides this that NMAP has
is you can specify the source port with dash G option.
This can sometimes help bypass a firewall.
For example, a network administrator may set up a firewall
and set a rule where only traffic from a certain port
is allowed.
And with that he's probably thinking that attackers
won't be able to figure out from which port exactly.
And if you perform a scan and send packets
from the port that's allowed in the firewall rule,
you successfully bypass firewall.
So you would specify it with dash G
and then random port number.
And one last thing that we will mention that would help you
in bypassing fireball is changing different scan types.
We already covered some scan types
and any of them could be useful to you sometimes.
For example, in case you perform a SYN scan
on a target machine and in case the SYN scan is blocked
by the target's firewall
which would mean that they drop all SYN requests
that try to initiate TCP connection,
we could try to perform a FIN scan.
And FIN scan is labeled like this, dash sF.
Now, you're probably confused because there are a lot
of scans that we can do.
And in case you don't have any networking background
you're probably wondering what FIN scan even means.
Well, FIN scan is just sending a FIN packet
without any other flags.
And these SYN flags and FIN flags can be confusing sometimes
but with practice you will catch everything up.
Just one advice I have is that every time
you don't fully understand something, just Google it.
That is how I learned as well.
And all of these options that we covered can be combined
with something called Timing Template.
And to show you what Timing Template really is,
I opened up my NMAP manual right here,
and I scrolled to this option right here
which says, dash D Timing Template.
And if you also open up NMAP manual
this will be all the way down.
So there are about one or two minutes of scrolling
until you reach this option.
Here in the NMAP manual we can see the dash T
comes with six different options or six different modes.
And what's interesting for us regarding security evasion
are the first two modes which are zero and one,
also called, paranoid, and sneaky.
These two are used for IDS evasion as it says right here.
Now the problem with T zero and T one
or the first two options is since they're trying
to avoid IDS alerts they will take a lot longer to finish.
So once you're scanning more machines or more networks
this might not be the most reasonable approach to take
since this scan will take a lot of time
with specifying dash D zero or dash D one.
And all of this including the options that we cover
in the last video will help you in security evasion
and spoofing.
What I would advise you to do is also read about
other options as well that we didn't cover
just to see what else can you do.
In the next video, big things are happening.
We're going to create our first tool
used for penetration testing.
Let's do it.