Shroud is a proof of concept of an anti-SYN scan based on false positive flooding.
Basically it looks for incoming tcp SYN packets on host's closed ports and reply with SYN-ACK packet to initiate a three way handshake properly.
Below an example of the results of the nmap -sS 127.0.0.1 -p- scan on a sample host not running shroud:
Starting Nmap 7.40 ( https://nmap.org ) at 2017-04-29 19:45 CEST
Nmap scan report for localhost.localdomain (127.0.0.1)
Host is up (0.0000040s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https
22/tcp open ssh
Nmap done: 1 IP address (1 host up) scanned in 0.76 seconds
And the results of the same scan running shroud:
Starting Nmap 7.40 ( https://nmap.org ) at 2017-04-29 20:37 CEST
Nmap scan report for localhost.localdomain (127.0.0.1)
Host is up (0.021s latency).
PORT STATE SERVICE
1/tcp open tcpmux
2/tcp open compressnet
3/tcp open compressnet
4/tcp open unknown
5/tcp open rje
6/tcp open unknown
7/tcp open echo
8/tcp open unknown
9/tcp open discard
10/tcp open unknown
11/tcp open systat
12/tcp open unknown
13/tcp open daytime
14/tcp open unknown
15/tcp open netstat
16/tcp open unknown
17/tcp open qotd
18/tcp open msp
19/tcp open chargen
20/tcp open ftp-data
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
24/tcp open priv-mail
25/tcp open smtp
26/tcp open rsftp
27/tcp open nsw-fe
[...]
65531/tcp open unknown
65532/tcp open unknown
65533/tcp open unknown
65534/tcp open unknown
65535/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 10.88 seconds
You can compile shroud with:
mkdir build
cd build
cmake -DCMAKE_BUILD_TYPE=Debug -G "CodeBlocks - Unix Makefiles" <path to shroud project>
make
shroud needs root permission to run properly because of raw socket usage.
It happens because you have to disable OS' RST responses to SYN packet sent to closed ports because if they are sent before the SYN-ACK (and they are!) the port scanner will know the ports are closed.
You could do this with a simple iptables rule:
iptables -A OUTPUT -p tcp --tcp-flags RST RST -j DROP