Collection of key technical papers, published research articles and reference manuals to understand the profound architecture of network analysis.
The seminal article that revolutionized network audit. It describes theoretical and practical methods to identify open, closed or leaked ports using the strict anomalies and requirements of TCP RFC 793.
# Sondeo sigiloso SYN sin completar el handshake:
Host A ------ SYN -----> Host B (Puerto 80)
Host A <-- SYN/ACK ---- Host B (¡Puerto Abierto!)
Host A ------ RST -----> Host B (Cierre inmediato y sigiloso)
Math and low level explanation of how different operating systems (Linux, Windows, FreeBSD, Cisco IOS, Apple Darwin) implement subtle variations in initial sequence number generation (NSI), TCP options (MSS, Window Scale, SACK, Timestamp) and TTL calculation.
Ghosstless sends a 9-pack flash especially designed to capture the remote system's "fingerprint" and to compare it with a database with more than 6,000 known fingerprints.
A technique that allows scanning a target without sending a single package directly from your actual IP address. It uses an intermediary host ("zombie") with a predictable IP ID counter to infer remote port status with complete anonymity.
$ ghosstless -sI zombie-host.example.com 192.168.1.1
Manual for development of offensive and defensive scripts. Contains detailed references of native libraries nmap.socket, dns, http, vulns y tls to automate complex penetration tests.
-- Ejemplo de script de auditoría GSE en Lua:
local http = require "http"
local shortport = require "shortport"
portrule = shortport.http
action = function(host, port)
local resp = http.get(host, port, "/")
return "Server banner: " .. resp.header["server"]
end
When IDS / IPS perimeter systems block regular probes, Ghosstless offers raw and camouflage packet fragmentation techniques by signage:
-f: Fragments packets into pieces of 8 bytes to cover up the TCP header in the second IP fragment.--mtu 16: Specifies a custom MTU size for controlled fragmentation.-D RND:10: Generates 10 random lure IP addresses simultaneously to flood the administrator's login.--source-port 53: Sends packages from UDP / TCP 53 port (DNS) to misset firewall rules.