PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-15 20:29:03 +00:00
Code Issues Projects Releases Wiki Activity

Start sending a valid encapsulated header with IP-in-IP with -sO. Hosts respond more when a valid header is sent. I kept getting open|filtered for this, and now I get open. It's a lot like my IGMP patch from r4361

Browse Source
This commit is contained in:
kris
2007-01-27 04:36:24 +00:00
parent 71ed5177c4
commit 1e3760a397
2 changed files with 21 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
CHANGELOG
View File

@@ -31,9 +31,10 @@ o Fixed a bug which caused nmap --iflist to crash (and might have
o Applied a bunch of code cleanup patches from Kris Katterjohn.
o Changed the IP protocol scan so that it sends actual IGMP headers when
scanning protocol number 2. This makes it much more likely that the host
will respond, proving that it's "open". [Kris]
o Changed the IP protocol scan so that it sends actual IGMP and IPIP
(IP-in-IP encapsulation) headers when scanning protocol numbers 2
and 4, respectively. This makes it much more likely that the host
will respond, proving that they're "open". [Kris]
o Fixed UDP scan so that it doesn't find it's own port when scanning
localhost. This was thought to be fixed in 4.10. This also prevents a

17
scan_engine.cc
View File

@@ -2203,6 +2203,23 @@ static UltraProbe *sendIPScanProbe(UltraScanInfo *USI, HostScanStats *hss,
&packetlen);
break;
case IPPROTO_IPIP:
/* This is our inner IP header, followed by data */
packet = build_ip_raw(&o.decoys[decoy], hss->target->v4hostip(),
IPPROTO_TCP, /* fake it */
o.ttl, ipid, IP_TOS_DEFAULT, false,
o.ipoptions, o.ipoptionslen,
o.extra_payload, o.extra_payload_length,
&packetlen);
/* This is our outer IP header, followed by the inner header above */
packet = build_ip_raw(&o.decoys[decoy], hss->target->v4hostip(),
pspec->proto,
o.ttl, ipid, IP_TOS_DEFAULT, false,
o.ipoptions, o.ipoptionslen,
(char *) packet, packetlen,
&packetlen);
break;
default:
packet = build_ip_raw(&o.decoys[decoy], hss->target->v4hostip(),
pspec->proto,