# Checkpoint Firewall Recon

> Reconnaissance and vulnerability assessment for Check Point Firewall-1 systems. Use this skill whenever the user needs to enumerate Check Point firewalls, discover firewall/management station hostnames via port 264, or assess HTTP Security Server format string vulnerabilities (CAN-2004-0039). Trigger on mentions of Check Point, CP, Firewall-1, port 264, SecuRemote, or firewall enumeration tasks.

- Skill: `abelrguezr/checkpoint-firewall-recon` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/checkpoint-firewall-recon`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/checkpoint-firewall-recon/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/checkpoint-firewall-recon

---


# Check Point Firewall-1 Reconnaissance

This skill provides techniques for enumerating Check Point Firewall-1 systems and assessing known vulnerabilities. Use these methods during authorized security assessments only.

## When to Use This Skill

- Enumerating Check Point firewalls in a network
- Discovering firewall and management station hostnames
- Assessing HTTP Security Server format string vulnerabilities
- Port 264/TCP reconnaissance
- Security audits of Check Point infrastructure

## Prerequisites

- Authorized access to target systems
- Network connectivity to target firewall
- Basic pentesting tools (nc, Metasploit optional)

## Technique 1: Port 264 Hostname Discovery

Check Point Firewall-1 exposes the SecuRemote Topology service on port 264/TCP. This service can reveal the firewall hostname and SmartCenter management station name.

### Method A: Metasploit Module

If Metasploit is available, use the built-in auxiliary module:

```bash
use auxiliary/gather/checkpoint_hostname
set RHOST <target_ip>
run
```

**Expected output:**
```
[*] Attempting to contact Checkpoint FW1 SecuRemote Topology service...
[+] Appears to be a CheckPoint Firewall...
[+] Firewall Host: <hostname>
[+] SmartCenter Host: <management_hostname>
```

### Method B: Direct Socket Query

Send a raw query to port 264 and parse the response:

```bash
printf '\x51\x00\x00\x00\x00\x00\x00\x21\x00\x00\x00\x0bsecuremote\x00' | nc -q 1 <target_ip> 264 | grep -a CN | cut -c 2-
```

**Expected output:**
```
CN=<hostname>,O=<organization>
```

**Script:** Use `scripts/checkpoint-264-discovery.sh` for automated discovery.

## Technique 2: HTTP Security Server Format String Vulnerability (CAN-2004-0039)

### Affected Versions

- NG FCS, NG FP1, NG FP2, NG FP3 HF2
- NG with Application Intelligence R54/R55

### Requirements

- HTTP Security Server or AI HTTP proxy must be enabled
- Transparent inspection of the targeted port
- If HTTP inspection is disabled, the vulnerability is not exploitable

### Detection

Send a malformed HTTP request with format string specifiers. If the firewall (not backend) responds with reflected payload, the proxy is active:

```bash
printf 'BOGUS%%08x%%08x%%08x%%n HTTP/1.0\r\nHost: internal.local\r\n\r\n' | nc -nv <firewall_ip> 80
```

**Indicators of vulnerability:**
- Immediate response from firewall (not backend server)
- Response contains hex values or format string output
- Error page generated by proxy with attacker-controlled content

**Script:** Use `scripts/checkpoint-http-format-string.sh` for automated testing.

### Exploitation Concepts

#### Format String Primitive

1. Force parser into error routine (invalid method/URI/headers)
2. Place attacker-controlled dwords at the start
3. Use `%x`/`%s` to leak pointers
4. Use `%n`/`%hn` to write formatted byte counts to chosen addresses
5. Overwrite return pointers, vtables, or heap metadata
6. Hijack execution with shellcode or ROP

#### Heap Overflow Primitive

The unsafe `sprintf()` writes to a fixed-size heap buffer:

1. Send long request body with oversized directives (e.g., `%99999x`)
2. Formatted output overruns allocation
3. Corrupt adjacent heap structures
4. Forge freelist pointers or function tables
5. Trigger dereference for code execution

### Impact

Successful exploitation grants:
- Code execution in firewall process (SYSTEM on Windows, root on UNIX)
- Rule manipulation capabilities
- Traffic interception
- Pivot point into management network

## Safety and Legal Considerations

- Only use on systems you own or have explicit authorization to test
- Document all findings for the authorized party
- Report vulnerabilities through proper channels
- This information is for defensive security and authorized assessments only

## References

- [Check Point SK69360](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk69360)
- [CISA Alert 2004-02-05](https://www.cisa.gov/news-events/alerts/2004/02/05/http-parsing-vulnerabilities-check-point-firewall-1)
- [ISS X-Force Alert 162](http://xforce.iss.net/xforce/alerts/id/162)
- [LFF-IPS-P2 Vulnerability Analysis](https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html#check-point-firewall-1-topology-port-264)