Lab 2: Evade Firewalls using Various Evasion Techniques

Module 12: Evading IDS, Firewalls, and Honeypots

Lab 2: Evade Firewalls using Various Evasion Techniques

Task 1: Bypass Windows Firewall using Nmap Evasion Techniques

terminal

sudo su

nmap 10.10.10.10

the output of the Nmap scan shows that all the 1,000 scanned ports on 10.10.10.10 are filtered.

if that shows then its good means the windows has firewall

nmap -sS 10.10.10.10

Observe that the results are the same as when the Windows 10 Firewall is turned on.

nmap -T4 -A 10.10.10.10

should show same thing

nmap -sP 10.10.10.0/24

this is to scan the whole network

per the scan result, you can observe that the Windows Server 2019 machine is Active (10.10.10.19)

do a zombie scan now

nmap -sI 10.10.10.19 10.10.10.10

this will show the open ports on the system beacuase it thinks your that server

---------------------------------------------------------------------------------------------------------------------------------------

Module 12: Evading IDS, Firewalls, and Honeypots

Lab 2: Evade Firewalls using Various Evasion Techniques

Task 2: Bypass Firewall Rules using HTTP/FTP Tunneling

HTTP tunneling technology allows attackers to perform various Internet tasks despite the restrictions imposed by firewalls.

This method can be implemented if the target company has a public web server with port 80 used for HTTP traffic that is

unfiltered by its firewall. This technology encapsulates data inside HTTP traffic (port 80). Many firewalls do not examine

the payload of an HTTP packet to confirm that it is legitimate, thus it is possible to tunnel traffic via TCP port 80.

HTTPort allows users to bypass the HTTP proxy, which blocks Internet access to e-mail, instant messengers, P2P file sharing,

ICQ, News, FTP, IRC, etc. Here, the Internet software is configured, so that it connects to a local PC as if it is the

required remote server; HTTPort then intercepts that connection and runs it via a tunnel through the proxy. HTTPort can

work on devices such as proxies or firewalls that allow HTTP traffic. Thus, HTTPort provides access to websites and Internet

apps. HTTPort performs tunneling using one of two modes: SSL/CONNECT mode and a remote host.

The remote host method is capable of tunneling through any proxy. HTTPort uses a special server software called HTTHost,

which is installed outside the proxy-blocked network. It is a web server, and thus when HTTPort is tunneling, it sends a

series of HTTP requests to the HTTHost. The proxy responds as if the user is surfing a website and thus allows the user to

do so. HTTHost, in turn, performs its half of the tunneling and communicates with the target servers. This mode is much

slower, but works in the majority of cases and features strong data encryption that makes proxy logging useless.

Here, we will learn how networks can be scanned, and how to use HTTPort and HTTHost to bypass firewall restrictions and

access files.

long lab refer to blog good luck

Lab Scenario

Firewalls and IDSs are intended to prevent port scanning tools such as Nmap, from receiving a precise measure of significant data of the frameworks that they are scanning. However, these prevention measures can be easily overcome: Nmap has numerous features that were created specifically to bypass these protections. It has the ability to issue a mapping of a system framework, through which you can view a substantial amount of information, from OS renditions to open ports. Firewalls and interruption recognition frameworks are made to keep Nmap and other applications from obtaining that data.

As an ethical hacker or penetration tester, you will come across systems behind firewalls that prevent you from attaining the information that you need. Therefore, you will need to know how to avoid the firewall rules and to glean information about a host. This step in a penetration test is called Firewall Evasion Rules.

Lab Objectives

Bypass windows firewall using Nmap evasion techniques
Bypass firewall rules using HTTP/FTP tunneling

Overview of Firewalls Evasion Techniques

A firewall operates on a predefined set of rules. Using extensive knowledge and skill, an attacker can bypass the firewall by employing various bypassing techniques. Using these techniques, the attacker tricks the firewall to not filter the malicious traffic that he/she generates.

The following are some firewall bypassing techniques

Port Scanning
Firewalking
Banner Grabbing
IP Address Spoofing
Source Routing
Tiny Fragments
Using an IP Address in Place of URL
Using Anonymous Website Surfing Sites
Using a Proxy Server
ICMP Tunneling
ACK Tunneling
HTTP Tunneling
SSH Tunneling
DNS Tunneling
Through External Systems
Through MITM Attack
Through Content
Through XSS Attack

Task 1: Bypass Windows Firewall using Nmap Evasion Techniques

Network/security administrators play a crucial role in creating security defenses within an organization. Though such defenses protect the machines in the network, there might still be an insider who may try to apply different evasion techniques to identify the services running on the target.

In this scenario, consider an admin has written certain Windows Firewall rules to block your system from reaching one of the machines in the network. You will be taught to use Nmap in such a way that you can perform recon on the target using other active machines on the network and identify the services running on the machine along with their open ports.

Task 2: Bypass Firewall Rules using HTTP/FTP Tunneling

HTTP tunneling technology allows attackers to perform various Internet tasks despite the restrictions imposed by firewalls. This method can be implemented if the target company has a public web server with port 80 used for HTTP traffic that is unfiltered by its firewall. This technology encapsulates data inside HTTP traffic (port 80). Many firewalls do not examine the payload of an HTTP packet to confirm that it is legitimate, thus it is possible to tunnel traffic via TCP port 80.

HTTPort allows users to bypass the HTTP proxy, which blocks Internet access to e-mail, instant messengers, P2P file sharing, ICQ, News, FTP, IRC, etc. Here, the Internet software is configured, so that it connects to a local PC as if it is the required remote server; HTTPort then intercepts that connection and runs it via a tunnel through the proxy. HTTPort can work on devices such as proxies or firewalls that allow HTTP traffic. Thus, HTTPort provides access to websites and Internet apps. HTTPort performs tunneling using one of two modes: SSL/CONNECT mode and a remote host.

The remote host method is capable of tunneling through any proxy. HTTPort uses a special server software called HTTHost, which is installed outside the proxy-blocked network. It is a web server, and thus when HTTPort is tunneling, it sends a series of HTTP requests to the HTTHost. The proxy responds as if the user is surfing a website and thus allows the user to do so. HTTHost, in turn, performs its half of the tunneling and communicates with the target servers. This mode is much slower, but works in the majority of cases and features strong data encryption that makes proxy logging useless.

Here, we will learn how networks can be scanned, and how to use HTTPort and HTTHost to bypass firewall restrictions and access files.