1) is there any tools available out there that can provide a tunneled ssl connection between me and that target?

2)Also i am sure if they will have some stateful firewalls ,so if they see an huge amount of out-bound traffic to a specific ip,they will get more suspicious,So how can i manage this?

3)Also they may have IDS in place,mostly a signature based 1,they may have a signature detection for ssl tunnel,how we can use our "methods" to deviate from the IDS signature,I am looking forward to modify or do some changes in the attack pattern,which needs to confuses the IDS and need to bypass it's patterns?

how can i do this?

4)what are some of the other attacks i can use against a state-full firewall?/quote]


1. Try out the following programs and play with them:
- SSL Tunnel: http://www.stunnel.org/
- ICMP Tunnels:
http://neverfear.org/blog/view/9/Using_ICMP_tunneling_to_steal_Internet
http://icmpshell.sourceforge.net/
http://phrack.org/issues.html?issue=49&id=6#article
And so forth, there's plenty of tools available. You can even install a VPN client on the target victim, and then set up a VPN server too with e.g. OpenVPN and SSL.

2. This is harder to manage, but if you relay your traffic via e.g. facebook, twitter or google then it may not look that suspicious. I remember I saw.. I think it was a botnet (for testing purposes) which was run via twitter. Quite evil, but it worked.

3. Install Snort and these "SSL filters" you're talking about. Then try to bypass them. That's what I would do, if I don't know the exact filters I would do a general bypass without making the packets look obscure since some firewalls and filters may put a red flag on them. Furthermore, using other kinds of packets such as ICMP (tunneling data through it), may be even better.

4. Spoofed (UDP) packets is just one kind of attack. You can't use that, to actually "attack" the firewall except if the SPI interface is vulnerable to certain types of obscure packets.



Best regards,
MaXe

I wouldn't worry about it much. Cursors are supposed to move on their own. And those connections to APNIC, figment of your imagination.

I want know what sort of  network architecture they are using ?

-- Social Engineering including spoofed e-mails may help you.
Also, check if they've outsourced their website to a 3rd party hoster. If yes then you need to know how that hoster functions etc. etc.

how can i determine the number of DMZ they are having?

-- By hacking the router. From the router it's virtually impossible except if it's a misconfigured (and probably older version of a) Cisco router where you can in some cases read the configuration directly via SNMP.

will they have a seperate DMZ for running database servers?if yes how to detect it?

-- Depends on how they configured their network. Some websites uses a local socket to connect to a database hosted locally while other sites uses a database hosted externally on another server or perhaps, virtual machine. The easiest way to find out where the database is, is to hack the website and read the config.php file if you can't find any hosts with port 3306 (mysql) open in their network range. You should only look for MySQL if the site is running PHP since this is the most common setup.



Is it possible to get the kernel version of the linux-sever they are using?
Also,i already nmapped it,it is saying the kernel version is from 2.4-2.6 kernel,I need to know exact version of kernel ,what should i do?

-- Again, by hacking the website you can in some scenarios run commands directly on the server, e.g. via LFI, RFI, RCE and in some cases SQLi. On linux a simple "uname -a" will tell you what you need, but you need to find a way to get remote code execution which can also be done with Social Engineering and bruteforcing too. (FTP, SSH, website and perhaps their e-mails too.)


Also i seen some smtp and pop3 services on the cisco firewalls/routers,
This looks strange to me,why a router/firewall is running smtp/pop3 services?

-- Probably "port forwarded" services. (They typically use the same IP as the router.)

want to finger print the web-Application firewall being used on the target,how can i do it?

-- Not exactly sure, are you certain there is one? In many cases there isn't though I have seen many companies use IDS's and IPS's where the last is kinda the same as a WAF. Input / Output checking is one way to check this in some cases though the problem is that it could also be the actual web application doing this.