RE: scanning NATed network question

["Amin Tora" <atora () EPLUS com>]

The only analysis I've seen so far is using cronos for OS fingerprinting
based on syn/ack responses from target during a syn scan - where the
time interval for each syn/ack response from the target is used to
identify the OS.

 Syn->

        <-- syn/ack
        <-- syn/ack
        <-- syn/ack
        <-- syn/ack
        <-- syn/ack...etc.

And this is only possible when the firewall allows the initial syn to
the internal host.... 


Amin Tora, CISSP, CHSP
Security Consultant
ePlus Technology Inc.
13595 Dulles Technology Drive
Herndon, VA 20171
office: 703-793-1330
cell: 703-675-0738
web: http://www.eplustechnology.com
email: atora-at-eplus.com

**NOTICE**
------------------------------------------
THE INFORMATION CONTAINED IN THIS ELECTRONIC TRANSMISSION AND ANY
ATTACHMENTS HERETO IS CONSIDERED PROPRIETARY AND CONFIDENTIAL.
DISTRIBUTION OF THIS MATERIAL TO ANYONE OTHER THAN THE ADDRESSED IS
PROHIBITED. ANY DISCLOSURE, COPYING, DISTRIBUTION OR USE OF THE CONTENTS
OF THIS TRANSMISSION OR ANY ATTACHMENTS HERETO FOR ANY REASON OTHER THAN
THEIR INTENDED PURPOSE IS PROHIBITED. IF YOU HAVE RECEIVED THIS
TRANSMISSION IN ERROR, PLEASE CONTACT THE SENDER.
------------------------------------------




-----Original Message-----
From: cluster () earthlink net [mailto:cluster () earthlink net] 
Sent: Monday, May 17, 2004 9:52 PM
To: Bob Radvanovsky
Cc: lepka () ukr net; security-basics () securityfocus com
Subject: Re: scanning NATed network question

i though you'd like a link to the download, so here it is:
http://download.gna.org/cronos/

Bob Radvanovsky wrote:
> Yesh, there is, but is difficult to find.  Look for a patched version 
> of NMAP called "Cronos", which will enable you to traverse a NAT'ed
firewall.
> ;)
>
> Cheers.
>
> Bob Radvanovsky [/unixworks]
> "knowledge squared is information shared."
> rsradvan(at)unixworks(dot)net
>
> ----- Original Message -----
> From: <lepka () ukr net>
> To: <security-basics () securityfocus com>
> Sent: Saturday, May 15, 2004 12:55 AM
> Subject: scanning NATed network question
>
>
>
> > Is it posible to scan a NATed network using nmap or other tool?
> >
> > Thanks, Scyth
> >
> > ----------------------------------------------------------------------
> > ----
>
> -
>
> > Ethical Hacking at the InfoSec Institute. Mention this ad and get $545

> > off any course! All of our class sizes are guaranteed to be 10 
> > students or
>
> less
>
> > to facilitate one-on-one interaction with one of our expert
instructors.
> > Attend a course taught by an expert instructor with years of 
> > in-the-field pen testing experience in our state of the art hacking 
> > lab. Master the
>
> skills
>
> > of an Ethical Hacker to better assess the security of your
organization.
> > Visit us at:
> > http://www.infosecinstitute.com/courses/ethical_hacking_training.html
> > ----------------------------------------------------------------------
> > ----
>
> --
>
>
> ----------------------------------------------------------------------
> ----- Ethical Hacking at the InfoSec Institute. Mention this ad and 
> get $545 off any course! All of our class sizes are guaranteed to be 
> 10 students or less to facilitate one-on-one interaction with one of 
> our expert instructors.
> Attend a course taught by an expert instructor with years of 
> in-the-field pen testing experience in our state of the art hacking 
> lab. Master the skills of an Ethical Hacker to better assess the
security of your organization.
> Visit us at: 
> http://www.infosecinstitute.com/courses/ethical_hacking_training.html
> ----------------------------------------------------------------------
> ------


------------------------------------------------------------------------
---
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545
off any course! All of our class sizes are guaranteed to be 10 students
or less to facilitate one-on-one interaction with one of our expert
instructors. 
Attend a course taught by an expert instructor with years of
in-the-field pen testing experience in our state of the art hacking lab.
Master the skills of an Ethical Hacker to better assess the security of
your organization. 
Visit us at: 
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
------------------------------------------------------------------------
----


---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
any course! All of our class sizes are guaranteed to be 10 students or less
to facilitate one-on-one interaction with one of our expert instructors.
Attend a course taught by an expert instructor with years of in-the-field
pen testing experience in our state of the art hacking lab. Master the skills
of an Ethical Hacker to better assess the security of your organization.
Visit us at:
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------