The simple stealth zombie scan

Let's use a machine on the network to send a SYN to the server.

We send a SYN-ACK (we're acting crazy) to receive a reset (actually, we want the IP ID - 1234).
This way, we'll pretend to be the zombie machine the whole time.

Now we send a SYN to the server.
The server returns a SYN-ACK, but not to us, but to the zombie machine (since the ID that sent the SYN is not ours).
The zombie machine will freak out and send a reset (RST) again, this time to the server.
Then, AGAIN (in red), we send a SYN-ACK to receive a RST (of course, to receive a new IP ID).

	NMAP Command (-sI)

	192.168.0.150 -> Zumbi PC
	192.168.100.1 -> Target PC
	-Pn -> Whithout ICMP ping
	-n  -> No resolution names
	-p80,21 ou -p80-100  (-r to no randomize)

	nmap -sI 192.168.0.150 -Pn -n -p80 --packet-trace -v 192.168.100.1

Or we can use python with Scapy:

	from scapy.all import IP, TCP, sr1
	import time


	ZOMBIE_IP = "192.168.0.50"  
	TARGET_IP   = "192.168.0.100" 
	TARGET_PORT = 80             
	TIMEOUT   = 2

	# -------------------------
	# Function to get the current IP ID of the zombie
	# -------------------------
	def get_ip_id(zombie_ip):
		# We send a SYN-ACK to the zombie to trigger a RST and capture the IP ID
		pkt = IP(dst=zombie_ip) / TCP(dport=80, flags="SA")
		resp = sr1(pkt, timeout=TIMEOUT, verbose=0)
		if resp and resp.haslayer(IP):
			return resp[IP].id
		return None

	# -------------------------
	# Function to send a spoofed SYN to the target (appearing to come from the zombie)
	# -------------------------
	def send_spoofed_syn(zombie_ip, target_ip, target_port):
		pkt = IP(src=zombie_ip, dst=target_ip) / TCP(dport=target_port, flags="S")
		sr1(pkt, timeout=TIMEOUT, verbose=0)

	# -------------------------
	# EXEC
	# -------------------------

	# Step 1 - Get initial IP ID of zombie
	ip_id_before = get_ip_id(ZOMBIE_IP)
	print(f"[+] Zumbi initial IP ID  : {ip_id_before}")

	# Step 2 - Send spoofed SYN to the target (as if it were the zombie)
	send_spoofed_syn(ZOMBIE_IP, TARGET_IP, TARGET_PORT)
	print(f"[+] Spoofed SYN sent fromm zombie ({ZOMBIE_IP}) to {TARGET_IP}:{TARGET_PORT}")


	time.sleep(1)

	# Step 3 - Get IP ID after interaction
	ip_id_after = get_ip_id(ZOMBIE_IP)
	print(f"[+] IP ID after interaction: {ip_id_after}")

	# Step 4 - Decide whether the door is open or closed
	if ip_id_before is not None and ip_id_after is not None:
		diff = ip_id_after - ip_id_before
		if diff > 1:
			print(f"[!] Port {TARGET_PORT} probably OPEN (IP ID variou {diff})")
		else:
			print(f"[-] Port {TARGET_PORT} probably CLOSED (IP ID variou {diff})")
	else:
		print("[!] Unable to get zombie IP ID.")