Firewall and IDS/IPS Evasion

To determine firewall rules the -sA scan is very useful

Detecting the presence of IDS or IPS systems may get your IP blocked. It's useful to have multiple VPS boxes with different IPs to perform the pentesting from.

Decoys

Flag: -D

Generates random IP addresses (for example 5: -D RND:5) and uses them as sender addresses in the TCP headers in addition to our own actual address.

For good measure and to not get detected as a SYN Flood the IP addresses used should be alive.

It's possible to manually specify the source IP address with: -S usually with -e tun0 to specify the interface

Decoys can be used for SYN, ACK, ICMP scans, and OS detection scans

DNS Proxying

DNS usually uses port 53/UDP but some modern specifications also use 53/TCP (Zone transfer, DNSSEC).

For this, we can use port 53 as our own source port to be more highly trusted by some not perfectly setup IDS/IPS

--source-port 53