Re: New Snowden leak: British spy agency has secret program to enhance Nmap for stealthier scanning through Tor

[Daniel Miller <bonsaiviking () gmail com>]

On Tue, Jul 15, 2014 at 2:44 PM, Darren M <infodox () riseup net> wrote:

> This is already pretty much implemented as part of nmap at this stage.
>
> nmap --proxy socks4://127.0.0.1:9050 -sC -iL targets.txt

Darren,

Unfortunately, the --proxy option does not cover host discovery or the
portscan phase yet. It affects the TCP Nsock-based portions of Nmap only,
which for now consists of service version detection, NSE scripts. IPv6
support is not included. The best candidates for moving to Nsock (and thus
improving --proxy support) seem to be:

* forward DNS lookups (requires SOCKS4a or SOCKS5)
* TCP connect (-sT) scan (Jacek is working on this for GSOC)
* Adding SOCKS5 support, which enables IPv6 and UDP support
* reverse DNS (already uses Nsock, but it's UDP, so requires SOCKS5)
* IPv6 (both IPv6 proxies and IPv6 traffic, probably requires SOCKS5)


> That does the trick for me, although if they have some way of
> parallelizing it or something to make it "go faster" (I guess a set of
> scripts that do this over a few tor instances and send NEWNYM signals
> frequently to change the next connections source IP address?) it would
> be nice to figure out.

Most exit nodes will have policies that make port scanning impractical.
They probably have a way to automate checking of those policies and
managing exit nodes. On the other hand, a lot of these capabilities look
like very simple projects that are just packaged well to avoid duplication
of effort. Could be as simple as a torsocks wrapper.

Dan
_______________________________________________
Sent through the dev mailing list
http://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/