Firewall Bypass Scans

Techniques for scanning past a firewall. Note -sN (Null scan) is not the same as -sn (no port scan).

Null, FIN and XMAS scans may slip past Unix-based firewalls:

sudo nmap -sN HOSTS
sudo nmap -sF HOSTS
sudo nmap -sX HOSTS

An ACK scan can reveal whether ports are filtered or unfiltered:

sudo nmap -sA -Pn HOST

Some firewalls trust traffic purely by source port — scanning from a non-standard port may bypass the check. If a -g scan shows a single port, scanning from that port may exploit the misconfiguration:

sudo nmap -Pn -g port_number host

Fragmentation — -f splits packets into 8-byte fragments after the header; --mtu (a multiple of 8) sets a custom fragment size:

sudo nmap -Pn -f host

Loose/strict source routing, to route through a trusted host:

nmap -Pn --ip-options "L 192.168.1.1 192.168.1.32" host    # loose
nmap -Pn --ip-options "S hop1 hop2 hop3..." host           # strict