We've talked about controlling our speed when we're conducting scans, and that
's because there are IDS and IPS systems out there, but whether it be host or
network based that will come back and alert us if things start to look a little
bit too suspicious.
So there are rules put in place on IDS and IPSs to pick up either scan
detection that are very finely crafted rules that do the implements quite a bit
.
Or there's also holistic anomaly based detection that says, it analyzes the
traffic look at it says looking kind of suspicious might need to report or do
something with that.
We're not really getting into the IDS IPS portion of this just yet, just to
give you an example of how running a scan will actually look in terms of actual
network traffic.
And what we have here on the side screen here is a wire shark output of
standard traffic that I recorded while prepping for this actual skill that we
're working on right now.
I didn't run any scans in here, and as you can see, there's a lot of packets
that I picked up to the tune of 1,163 seconds. And as you see, and I want to
highlight zoom in for you.
The bars on the far right side where you see my mouse going up and down right
now.
And it shows their different areas of colorings of the packets based on moves
within a wire shark for display filters.
Reason to point this out is is because you don't even though you do see some
red packets like this one right here being a dropped packet or this one right
here with a TCP retransmission.
You don't see on the far right bar just shades of red and or black on there
indicating a massive scan attempt.
Now I'm going to restart this using a slow or excuse me, a quick scan on the
system to see if it triggers anything.
And by doing so, I'm going to select the network that we're actually on from
the Kali system. Now, do you remember that there are different IP addresses on
this particular box.
And that one that I just highlighted ethernet to is the actual network itself
for the virtual environment. That may not look like much right now, but I've
already started my scan and there's really not a lot of activity going on.
So I'm going to pull down my Kali system here and I'm going to move it out of
the way for you. You can see at least the top part of my
ongoing wire shark scan and try to run this in such a way to where we could see
both happening at the same time.
On the bottom portion that right there is the Kali virtual machine and I'm
inside a Zen map and I'm going to run just a quick scan and watch the traffic
flow.
And there you can see is exactly what I'm talking about inside of wire shark,
all those red packets that you see and I'm
going to make sure you go back into my virtual machine and make sure that done
it is. I can go ahead and stop the capture
You to see on the sidebar right here, all these different red areas. And that
indicates that there was a lot of either out of sequence or we'll select this
packet right here and dive into and show you want to talk about
Reset plaques. So it's trying to do the three way handshake with the TCP packet
.
Send Sinak and act, but what's happening is that we're actually getting a reset
flag sent to see if there's anything open on that particular system.
And as it so happens, there is those five ports right there on TCP. Now, that's
a lot of information and it's pretty quick happening and it's just doing a
quick pay are you there.
Well, I'm going to do the same thing again. And this time I'm going to drop it
down and clear out my settings by restarting
Saving go back into my Kelly box. Now I'm going to conduct an intent scan on
all TCP ports.
And you can see here that we have a lot of different red markers on here, which
is indicating that reset acknowledgement flag
That's correlating with an actual sin flag being sent for TCP verification.
This is where the actual
IDS or IPS would start having a panic attack because this is happening way too
fast for common network traffic to be deemed as normal.
So this is where we need to start taking a look at how we run these scans a
little bit slower.
And on the bottom here, you can see that I'm about to pull my Kelly system back
up and go into select the slow comprehensive scan.
And this is doing essentially the exact same thing is what we're seeing in wire
shark up top. It's just going at it a whole lot slower.
Now this is inside of our Kelly box and I'm going to zoom in for you and see
real quick that although it is set at slow comprehensive scan.
It's set at default variables. So you can actually change this up inside of the
terminal or inside of here in the command line for in map if you want
To make it even slower, but we're going to go ahead and do a side by side
comparison. I'm going to stop this real quick and start again. Go back into my
Kelly box and go ahead and hit scan.
Now it's already scanning and matter of fact, I'm going to get there we go. It
's already scanning
And you can see that the packets are accumulated inside of our chart, but not
at the same speed as what was going to happen in before when we were just doing
a flat out scan on to see ports.
Yes, it's still pretty fast. And yes, this could be slowed down a lot. But
there is a trade off here. You have to remember in terms of actually scanning
on the overall network.
And that is if we're trying to be discreet or we're just trying to go through
and get as much information as we can as quickly as possible.
As a pen test, we have to remember that we're
We're limited on the number of IP addresses that we can actually use
Sometimes and it could be that within the scope of our IP address if it's a red
team versus blue team scenario that red team is only allowed to use this this
block of IP addressing.
So let's say I go on IP address number one and go through and barn blast all of
the scanning on that to get my results, but I'm detected really quick.
Well, IP address number one has been disabled because the blue team was doing
what they were supposed to be doing and they blocked it.
So I moved IP address number two, which is in that same block of authorized red
team IPs and do the exact same thing because I didn't get all of my information
before.
Well, they blocked that too. And now they're starting to see a pattern and
block the entirety of the sub depth or potentially.
Well, that leaves us in a weird predicament because if they block all of the IP
s that the red team is authorized to use, we either have to get really crafty or
we have to break the rules, which inside of the DOD world is kind of brown on.
Now, it could be that we're geo dislocated and we're doing another attack in
terms of just been testing where the organization that we're protesting doesn't
know the IPs that we're actually going up against.
And that's OK, but it's still with the same idea and mine that slow and steady
wins the race.
And sometimes unless you're just pressed for absolute no time at all, then you
go through running over a boombox, not trying to catch any sounds that it's
making again trade off low and steady fast and furious. So this is where you as
a pen testers going to have to make that decision.