Table of Contents
Firewall/IDS Evasion and Spoofing (-f, -D)
Many corporate environments have intrusion prevention (IPS), perimeter firewalls and detection (IDS) systems. Ghosstless includes advanced technologies to avoid and audit the effectiveness of these filters.
| Flag | Mecanismo | Description and Objective |
|---|---|---|
-f |
IP fragmentation | Divide the TCP header into fragments of 8 bytes, making it difficult to inspect by basic ids signatures. |
--mtu <valor> |
MTU Personalizado | Specifies an exact fragment size (multiple of 8) for packet fragmentation. |
-D <decoy1,decoy2,ME,...> |
Scanning with Seamers | He sends parcels from several false IP addresses mixed with actual IP, flooding his security logs. |
-S <IP_Address> |
IP Spoofing | Suppand the source IP address into the probe packets (require passive monitoring of responses). |
-g / --source-port <puerto> |
Spoofing port | It sends probes from confidence ports as 53 (DNS) or 88 (Kerberos) to avoid permissive rules. |
--data-length <número> |
Data Filling | It adds random bytes to probe packets to prevent them from looking typical scanner signatures. |
--badsum |
Checksum Invalid | He sends parcels with mathematically wrong TCP / UDP checksum to determine if a firewall responded on behalf of his host. |
--proxies <url1,url2> |
Encadenamiento Proxy | Reshipments TCP connections through proxy HTTP or SOCKS4 / 5 servers. |