Conversation
When packets with source ip which is not the receiving address for replies (e.g. behin NAT) validation data was computed with the actual receiving address on receive. However, on send it is computed with the sending address. This discrepancy made valid packets fail validation. This commit fixes the discrepancy by trying every possible sender IP when validating a packet.
|
@phillip-stephens Looked at this briefly and the probe module itself looks reasonable. Would you be willing to help fix up types/tests issues, and merge? |
|
Validated that after fixing up merge conflicts from the past 2 years of changes, the scanning behavior was not changed. Let me just validate the packets generated look fine in Wireshark and then I'm good to merge. |
|
Looks fine to me, I'm not entirely sure what the purpose of the random |
4 participants
Add a probe module to scan for hosts with IPIP protocol (4) supported.
These hosts may be used for IP spoofing, NAT traversal or just lengthening the path which an IP traverses along the network.
Usage example:
zmap --target-port=53 --probe-module=ipip -i eth0.2For uses see: PoC||GTFO 0x21:3
This issue was responsibly disclosed two years ago to Cert CC