RE: [PEN-TEST] Detecting the presence of a firewall

From: Balunos, Don (don.balunosat_private)
Date: Tue May 15 2001 - 08:14:50 PDT

Next message: H D Moore: "Re: Access a remote registry"

Previous message: railwayclubposseat_private: "RE: [PEN-TEST] Detecting the presence of a firewall"
Maybe in reply to: priya subramanian: "[PEN-TEST] Detecting the presence of a firewall"
Next in thread: Frank Knobbe: "RE: [PEN-TEST] Detecting the presence of a firewall"
Next in thread: Magnus Bodin: "Re: [PEN-TEST] wireless LAN traffic sniffing"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Pls clarify the ff:

Can NMAP crash a Solaris machines running FW-1
by doing UDP scan including port 0...

Regards,
Don

-----Original Message-----
From: Frank Knobbe [mailto:FKnobbeat_private]
Sent: Monday, May 14, 2001 7:36 PM
To: PEN-TESTat_private
Subject: RE: [PEN-TEST] Detecting the presence of a firewall


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> -----Original Message-----
> From: railwayclubposseat_private
> [mailto:railwayclubposseat_private]
> Sent: Monday, May 14, 2001 11:44 AM
> 
> For Checkpoint, use nmap and do a TCP and OS detection scan. 
> If they are 
> doing one-to-many NAT the machines will be detected as 
> "behind a Checkpoint 
> Firewall-1 4.1 SP2 Server" or whatever. The firewall itself 
> is likely to 
> have some combination of  TCP ports 256-259, 264-265 open for 
> management,
> auth, key exchange, etc. 

What criteria is nMap using? What would the result be if a) the
well-known-Checkpoint-ports are closed, and b) the default TTL has
been monkied with? (Not you, Doug)

Regards,
Frank

-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.8
Comment: PGP or S/MIME encrypted email preferred.

iQA/AwUBOwBr75ytSsEygtEFEQIE4wCg+fYkOVgnUUKAJln7YbQYeNM4qzcAoM2u
8LKpwZ4q3fUbsdkz/YFxbDel
=3TZs
-----END PGP SIGNATURE-----

Next message: H D Moore: "Re: Access a remote registry"
Previous message: railwayclubposseat_private: "RE: [PEN-TEST] Detecting the presence of a firewall"
Maybe in reply to: priya subramanian: "[PEN-TEST] Detecting the presence of a firewall"
Next in thread: Frank Knobbe: "RE: [PEN-TEST] Detecting the presence of a firewall"
Next in thread: Magnus Bodin: "Re: [PEN-TEST] wireless LAN traffic sniffing"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue May 15 2001 - 09:33:17 PDT