On Thu, 24 May 2001, Jason Lewis wrote: > I am not sure how you identify the PIX. How do you fingerprint servers when (this is just an example) check for any open smtp ports, if they are behind a pix (any you have 'conduit smtp 25' or something like this in the config file, which most people do), it will say: 220 SMAP (and some other crap) > you don't know what the servers are or if they are behind a PIX? usually you don't have to (if by fingerprinting you mean nmap -O), they usually give out way too much information anyway. check the http server banner for starters, see if there is any ssh installed, try to get some mail relayed through their mailserver, like a mail delivery notofication, preferably to postmaster or webmaster asking some stupid question. by now you usually know if it is unix or nt. dig deeper... jacek
This archive was generated by hypermail 2b30 : Fri May 25 2001 - 12:05:20 PDT