[NSE] firewalking

[Henri Doreau <henri.doreau () gmail com>]

Hello hackers,

please find attached a NSE implementation of firewalk.

This script tries to guess a firewall ACL by probing a target behind it,
with a TTL one higher than the firewall. If the probe is forwarded by the
firewall, then we'll receive an ICMP_TIME_EXCEEDED from the firewall next
hop host (eventually the target), otherwise we won't receive anything, and
we can suppose that the probe was dropped by the gateway.

This is my very first lua and nse try, I'd like to have some
feedback/advises about it. For now, probes are tcp only, but I intend to add
udp support soon.

Because the script uses traceroute results to select the ttl value to use,
it requires the patch nse_traceroute.diff (attached).

Firewalk was originally written in C by M. Schiffman and D. Goldsmith but
isn't maintained anymore. I used qscan.nse and path-mtu.nse as references.
Thanks Kris for writing such nice scripts!


Regards

-- 
Henri Doreau

Attachment: nse_traceroute.diff
Description:

Attachment: firewalk.nse
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/