0x00->Overview On the official Kali website, the introduction to 0trace states: “This package is a routing tracing tool that can run on existing open TCP connections, allowing it to easily bypass certain types of stateful packet filters.” This tool is pre-installed in the Kali system. In Linux systems, it can be obtained using the command: sudo apt install 0trace. Note that 0trace depends on tcpdump and libc6 libraries. The basic command format is as follows: 0trace.sh [options] <target domain="" ip="" or=""> <target port=""></target></target>0x01->Key Parameter Analysis
| Parameter | Function | Example |
|---|---|---|
<span>-i <interface></interface></span> |
Specify the network interface | <span>-i eth0</span> |
<span>-p <port></port></span> |
Set the target port (default 80) | <span>-p 443</span> |
<span>-m <hops></hops></span> |
Maximum hop limit (default 30) | <span>-m 20</span> |
<span>-S <timeout></timeout></span> |
SYN/ACK response timeout (default 5000ms) | <span>-S 3000</span> |
<span>-n</span> |
Disable DNS reverse lookup | <span>-n</span> |
<span>-v</span> |
Display verbose output | <span>-v</span> |
A complete example: 0trace.sh -i eth0 -p 443 -m 20 -S 3000 -n baidu.com0x02->Operation and Precautions Prerequisites: 1. Ensure that the target host has open ports (such as HTTP 80, HTTPS 443) to establish a TCP connection. 2. Use Telnet or similar tools to establish a connection in advance (e.g.: telnet <target ip=""> 80</target>), and keep the connection active. Execution Process: 1. Use tools like telnet to establish a TCP connection; 2. Run the 0trace command in a new command line window; 3.The tool sends TCP SYN/ACK probe packets, gradually increasing TTL to obtain path nodes; 4.Output the routing path and node information, including IP addresses and response times. Result Analysis: 1. In the results, each node is displayed as Hop
2. If a hop shows as * , it indicates that the node did not respond or the firewall blocked the probe packet.
0x03->Applicable Scenarios and Limitations
Advantageous Scenarios:
1.Firewall Bypass: Utilize legitimate TCP connections to bypass stateful firewalls (e.g., rules that only allow established connections to pass).
2.Covert Probing: Compared to traditional ICMP/UDP Traceroute, TCP packets are less likely to be flagged as anomalies by security devices.
Limitations:
1. Dependent on the open status of the target port; if the port is closed, a connection cannot be established.
2. Some firewalls may detect abnormal TTL values and drop probe packets, resulting in incomplete path information.
0x04->Advanced Techniques
1.Multi-port Attempts: If the default port 80 is filtered, try other common ports (such as 443, 22) to increase success rates.
2.Combine with Wireshark Analysis: Capture TCP packets generated by 0trace to analyze firewall behavior and path details.
3.Debug Mode: Add the -D parameter to enable debug output to troubleshoot connection issues.