Nmap Command for penetration Testing (iv) use of bait

1. Brief description

The use of Nmap bait is a very interesting concept. We use Nmap to increase the host that initiates the scan, you do not get any information from the host of these baits, but it increases the difficulty of looking for a real scan host, or to find which IP is bad. Ideally, we should start with a sufficiently realistic "decoy" host before scanning, which can reduce the detection effort of the target administrator.

Using this in a scan allows the bait to increase the difficulty of judging the actual scan host. The real bait is the online host IP in the network.

It is worth noting that the bait is used when performing various types of scanning, so that you can use a variety of techniques when scanning.

2. Nmap Put bait scan

We test this virtual experiment environment, the 192.168.50.12 as the target host, 192.168.50.10 is to initiate the scanning host, 192.168.50.16 and 192.168.50.15 is the decoy host. Enter the following command on the target host (Kali Linux is used here):
　　nmap -D192.168.50.15,192.168.50.16,ME -p 21,22,80,443 -Pn 192.168.50.12

The-d switch means a decoy scan is implemented, followed by a list of IP addresses of the selected decoy hosts, and these hosts are online. -PN does not send a PING request packet,-P selects the port range to scan. The "ME" can be used instead of entering the IP of its own host.
The following are the scan results:

The results show that the ports 80 and 443 are open, and 21 and 22 are either filtered or off, in fact. Let's look at the firewall settings for the target host:

But the real highlight is not here, on the web. Let's take a look at the traffic (you can use Wireshark):
　　

Now looking at the source Address column, we will find that the decoy hosts we use constitute the main record of network traffic. As long as enough decoy hosts are used, a large number of records are generated in a short period of time, thus confusing and delaying the attention of the network administrator during the scan.

Nmap Command for penetration Testing (iv) use of bait