Firewalk is an active reconnaissance network scanner that will help determine what Layer 4 protocols our router or firewall will pass or deny. This is a great tool for finding a way through an environment by leveraging a bad or missing ACL within one of your network devices. Firewalk leverages ICMP error messages and TTL expirations to let us know whether a port is open or not, very similar to traceroute. If a port is opened or allowed, the packet destined for that port will typically be silently dropped by the security device. But, if the port is closed, the TTL of the packet will expire at the next hop and issue an ICMP_TIME_EXCEEDED error message.
Firewalk is a two-phase command. The first phase is called the hop ramping phase. Its sole job is to find the correct hop count to the target gateway so that is has the right TTL (hop count +...
