Firewalking is a technique that can be used to gather information about a remote network protected by a firewall. This technique can be used effectively to perform information gathering attacks. In this technique, an attacker sends a crafted packet with a TTL value that is set to expire one hop past the firewall. Which of the following are pre-requisites for an attacker to conduct firewalking? Each correct answer represents a complete solution. Choose all that apply.

Question

Accepted Answer

A. An attacker should know the IP address of a host located behind the firewall. The attacker must know the IP address of a host behind the firewall to use as the packet destination, ensuring the crafted packet's TTL expires exactly one hop past the firewall and triggers a revealing ICMP response. B. ICMP packets leaving the network should be allowed. ICMP time-exceeded messages must be permitted to leave the network outbound so the attacker can receive the TTL-expired responses that indicate which ports are accessible past the firewall. D. An attacker should know the IP address of the last known gateway before the firewall. The attacker must know the IP of the last known gateway before the firewall in order to accurately calculate the TTL value required for packets to expire one hop beyond that gateway.

Answer

C. There should be a backdoor installed on the network. Firewalking is an external active reconnaissance technique that probes firewall rules using crafted IP packets; it requires no pre-existing backdoor or insider access to the target network.

Firewalking is a technique that can be used to gather information about a remote network protected by a firewall. This technique can be used effectively to perform information gathering attacks. In…

Question

Options

How the community answered

Why each option

Topics

Community Discussion