© Mike D. Schiffman

Synopsis  Introduction  Overview  Impetus  Internals  Implementation  Risk Mitigation  Futures

Introduction  Firewalking: “Firewalking uses a traceroute-like IP packet analysis to determine whether or not a particular packet can pass from the attacker’s host to a destination host through a packet-filtering device.” “Firewalking uses a traceroute-like IP packet analysis to determine whether or not a particular packet can pass from the attacker’s host to a destination host through a packet-filtering device.”

Terminology  ACL  router/gateway  firewall

Slightly more detail  Map `pass-through` port Determine gateway ACLs Determine gateway ACLs Map hosts behind filtering gateways Map hosts behind filtering gateways

Importance  Network Reconnaissance Network mapping Network mapping Security auditing Security auditing

Base concepts  Traceroute  Network discovery tool  UDP packets  IP TTL Monotonic increments Monotonic increments

Sample network

IP TTL Sample traceroute

Info recon using traceroute  Protocol subterfuge  Nascent port seeding View hosts behind a firewall View hosts behind a firewall

Protocol subterfuge

Nascent port seeding 1 p0 = (p - (hops * probes)) = (53 - (8 * 3)) - 1

Nascent port seeding 2

Logical progression  Traceroute works at the IP layer Any protocol on top of IP can be used Any protocol on top of IP can be used  Prohibitive filter on a gateway Causes probes to be dropped Causes probes to be dropped  We can determine the last host that responded Different protocols Different protocols ‘Waypoint’ host ‘Waypoint’ host

Firewalking basics 1  Firewalking requires 3 hosts The firewalking host The firewalking host The gateway host The gateway host – The waypoint host from above The destination host The destination host – The host the sends the terminal packet in a traceroute scan – Must be ‘behind’ the gateway host – Used to direct the scan, never contacted

Firewalking basics 2  A packet are sent to (towards) the destination host  A timer is set If we get a response before the timer expires, the port is open If we get a response before the timer expires, the port is open If we do not, the port is probably closed If we do not, the port is probably closed  Repeat for all interesting ports/protocols

Firewalk internals 1  2 phases Network discovery phase Network discovery phase Scanning phase Scanning phase  Network discovery phase Required to get the correct TTL Required to get the correct TTL `TTL ramping` ala traceroute towards destination host `TTL ramping` ala traceroute towards destination host – This host is never contacted When gateway hopcount is determined, scan is `bound`. When gateway hopcount is determined, scan is `bound`.

Firewalk internals 2  Scanning phase Send a packet towards destination Send a packet towards destination – Packet is set to expire 1 hop (by default) past the gateway Set a timer and listen for response Set a timer and listen for response – If response is received before timer expires, protocol in question is allowed through – If not it is probably denied by the gateway (maybe)

Firewalking diagram

IP TTL 123 Sample firewalk: phase 1

IP TTL Bound at 3 hops Sample firewalk: phase 2 UDP/53 UDP/137 TCP/23 UDP/161 TCP/25

Nothing is ever as simple as it seems False negative scenario

False negative circumvention  `Slow walk` Firewalk each hop en route to the target Firewalk each hop en route to the target If a probe is shown to be filtered on an intermediate gateway, that protocol/port cannot be scanned any further on that route If a probe is shown to be filtered on an intermediate gateway, that protocol/port cannot be scanned any further on that route

Risk mitigation  Block egress ICMP TTL expired in transit messages  NAT or proxy servers can remove the threat of firewalking

Futures  More protocols to scan with  More intelligence on the part of the scan Make the program understand different packet types and what types of terminal packets it might get Make the program understand different packet types and what types of terminal packets it might get  Efficiency  Portability  A better, more stable GUI

Web resources  firewalk firewalk tracerx tracerx libnet libnet