Hello everybody and welcome back.
And before we begin with the options for this part of the editorial I just want to show you the output
of the previous candid we did.
And as we can see it discovered a port that is different than the port that these three previous cans
got us which was the port I believe 5 3 5 7 or something like that which was a DP port and instead of
that we got a UDP open port net buyers minus an S which runs on 1 3 7 on our laptop machine.
So you might notice that the UDP scan basically just gives you the output for UDP port which makes sense.
It will basically give you any UDP port which is open.
For example it could be these net buyers.
It could be your DNS or anything that is running over UDP.
This option right here will give you open UDP ports.
So now that we've covered that we covered basically the full three see three way DP handshake.
We covered that scene on the first part of trade three with shipping handshake and we cover the UDP
scanner.
So now that we covered all of those options I want to show you how you can avoid some of the defenses
that your target might have and how you can avoid your IBS.
So for example the first thing you might want to do if your target is blocking your map or you can get
any output for example you can try the minus as a option now as you said in the previous video minus
essay is listed where this is cancer since the A stands for Act which is the last part of three way
DCP handshake as you can see right here it is the third option and it stands for AK
i deleted this.
This
drawing that I did before.
Since it was really bad let me just try it once again.
Doesn't even matter.
This is the P.C. a this is the ECB.
And from a we want to say can be
but let's say your EU perform you try to perform a three way DCP handshake.
So it goes like this then this machine sends Sinek.
And once again you send ACH right here.
This one last is only the EC I really do encourage you to read more about this big handshakes since
this can be a little bit confusing if you don't know what am I talking about.
But basically the method behind this is the minus assay which is only the last part of three speak handshake
can be used to bypass some of the rules of your doctor for example if there is a rule that allows Sim
packets only from the internet work.
So what I just said is basically let's say this is some website that will only allowed the full three
way DCP handshakes or SIM packets which is the first part of the 360 handshake only from the Internet.
OK.
So basically only from the machines that are Ed on its local network and you as someone coming from
the Internet trying to send a sim packet to the machine being outside of your local network you will
get blocked.
And if that rule really exists on the target machine you can trick it by sending only the EC which is
the last part of three way DCP handshake which will treat the router or the site to think that it is
an answer to a previous Sim set so let's say this router is connected to some of the other devices on
its local network.
Now pardon me for my really bad drawing right here but basically the circle right here is representing
the internal network of these machines.
And it will only accept the three way handshakes or SIM packets syndicate bid sets from the machines
that are on its local network.
And you as someone coming from the outside trying to send the same packet will get blocked.
So if you only send the packet without sending the previous Sim packet or bits at it it is not a packet
it is basically a bit set from the DCP packet it might trick your counter to think that this act is
an answer to a previous scene bits it that some of the local machines sent so in order to do that you
just type here and map minus essay and let the IP address of your outer selected just type here.
Also
so basically you use this option if there is the blockage of sin bit set on the target machine.
Now this is not that common to see so you won't be needing it that much but it can happen.
Now the next thing you might want to specify is he bought this so support that your packets are going
from now by default the map sets distort which is deported from and which is your port from which you
send the packets to the machine.
It can be any port.
I believe the N map specifies it randomly at the beginning of the scan.
And it can be problem in case of where the target only allows the packets from the specific ports.
Now what I mean is let's say exempt for example you run and map scan from this machine and it basically
uses the port three three three for the outgoing scan which is a randomly assigned port for your machine
but once it gets to the target machine there is a rule on the target machine that this port will only
accept packages from the ports.
For example 80 so your packages no matter which type of option you specify whether it is the UDP scan
the X can Candy since scan or the 40s piece scan it will get blocked since your packets are not coming
from the outgoing port which is port 80
so in order for you to be able to scan this target you need to specify the port which it allows the
packets to come from.
So it will usually be some of the known ports which is for example port 53 for the DNS port twenty five
point eighty port 80 80.
It can be any of those widely known ports but it can also be any other random port so you will need
to find that out by yourself.
But once you do find out that by yourself you can just type here minus minus source port and then the
number of the source port for for example let's say the source port is 80 and then we type here the
IP address of our target machine.
And as we can see right here the IP address 0 hosts up.
Not really sure why that happens as we can see right here.
Host since down a bit is really up but blocking our ping pros trade minus.
So it minus PND which we covered in the previous tutorial but for some reason it doesn't want to show
us that the host is up.
Let me just see right here if I correctly specified this option minus minus source port I believe it
is but let's check once again where could it be.
Timing always detection scripts scan service port exclude or use
Port ratio fests can point down trend of mice and maybe they change this option.
I thought it was minus minus source minus point and it didn't give us any error.
So I believe it still is but for some reason our host is appearing to be down but we won't be really
wasting our time on that.
So basically religious recap.
You use that theme and you use the minus minus source minus port option when your target is only allowing
packets to come from certain ports for example as we saw 80 so let me just right here right here.
Minus minus source transport on nights through that 168 that fondant 8
and let us continue to the next step in order to bypass some of the detection problems which could be
the data lent now.
The map by default sends packets of specific size.
I'm pretty sure about the size is but I believe it sends the same size packets every time so some of
the defenses today have rules to the nice packets that are of Standard and map size.
Size.
Basically what that means is that any map every time when it sends packets it sends them with the same
size.
And if someone has a rule specified or nodes the 10 map exists it can make a rule that says basically
block any packet that is the size of the standard and map packet.
Now to bypass this detection system you can configure different packet sizes with the option minus minus
data minus length.
Now let me just type here normally.
So let us try that one out.
If we type here and map and then minus minus theta minus land can we specify for example 50 and we type
here the IP address didn't give us any error so it means that the that the syntax of the command is
correct.
So this taking a little bit of time it should give us this the correct output once it finishes.
So let me just type here.
The data lines on and to that 168 that on the date now of course you need.
You don't have to specify only this option once you can you can specify a bunch of options including
this one so you can basically use all of these three for example to combine into a scan which will bypass
all of all of these three detection problems which the first one is the blockage of simple steps.
The second one is blockage of specific ports.
And the third one is the blockage of the map standard packet size so we will cover one more in order
to bypass the detection and defense.
Right here we have the output of the scanners.
We can see it performed correctly and we have one open port which is DCP and the service running is
w as the AP.
So let us continue on to the next one which would be the spoofing of your mac address.
Now long ago one of the stories we covered how to change our mac address you can use that as well but
the map keeps us its own option to spoof our mac address and as we can see if we take your map I believe
it will show us the option right here.
Not really sure if it is listed yes it is it is right here we can also see the data length comment and
the source port as we can see.
I forgot wearables this option let me just right here in minus G as it says that it is same as minus
minus source port and it didn't work for us or let me just type here and met minus G and then quarter
80 and then one night to that 160 that wanted but to see if the horse is up right now and it is up.
So basically instead of this option minus minus our spot you can use Klein's Jeep and specify the port
of course so that's good.
I didn't know that existed but let us not care about that at the moment at the moment.
We want to spoof our mac address with this comment as we can see the syntax is minus minus spoof minus
Mac and then we add the MAC address right here you can add other options spell as prefix one to name
but it'll just type here.
The MAC address and we can see that the description for this option a spoof your MAC address.
So let us do that
the source sports can finish.
So let us just clear the screen and type here then map minus minus spoof minus Mac.
I believe that was the option and you type your mac address that you want to fake.
So let me just say this and to show you you can see right here that the or let us use the Mac changer.
We covered it before you type your minus minus show and then the network interface in order to see your
current MAC address.
So this is the format of the MAC address.
You can see it is divided by two dots.
And it is consistent from six parts that are basically divided by these two dots.
So you can just type here.
2 2 3 3 4 4 5 5 6 6 7 7.
And we right here type the IP address of our host or of our target.
And as you can see right here it is said it says spoofing MAC Address 2 2 3 3 4 4 5 5 6 6 7 7 No registered
vendor and host seems down.
If it's really up about blocking our pin code straight minus pen.
Now for some reason it seems that the host is down with that option.
It could be because we didn't really specify these two options but I doubt really we won't really bother
with that right now you just want.
I just want you to know about that option.
That for example it is used if this machine right here allows the packets to come only from certain
mac addresses it can be used as a blacklist or as a whitelist.
This machine can have a blacklist where it blocks some of the MAC addresses and some of those could
be yours as well or it could have whitelist where it only allows certain MAC addresses
now.
Most likely it will have a whitelist where it will allow only trusted devices with their MAC addresses
and in order for you to be able to send packets to this machine you need to spoof the MAC address of
a trusted device from these that these target machine specified in its whitelist.
And once you do that with the minus minus both minus Mac option you will be able to send packets and
receive packets from the target's machine.
So let us type right here minus minus source or not source it is spoof I believe.
Let me just see what was the option spoof Mac.
And then you basically just type here 3 3 4 4 5 5 6 6 7 7.
It doesn't have to be this MAC address.
You can basically specify countries you want.
And right here you type the IP address of your target or the whole thing doesn't really matter.
So that would be about it for the avoiding defence in IP as these four things can be useful if your
target specify some of the rules in order to block your scans but you will find out that really targets
use any of these rules to prevent you from scanning them but if it happens you can use these options
that we covered in this video.
Now the next video I will show you better and map scripts how to get to them and how to use that.
So I hope you join this editorial and I hope I see you in the next one by.