Re: Application-based fingerprinting ?

From: Dave Aitel (daveat_private)
Date: Tue Feb 04 2003 - 10:15:20 PST

  • Next message: Pete Herzog: "RE: Proposal?"

    Check packetstorm for various implementations of FTPD, FINGERD, TELNETD,
    etc fingerprinters.
    
    -dave
    
    
    On Tue, 04 Feb 2003 08:22:02 +0100
    Anders Thulin <Anders.Thulinat_private> wrote:
    
    > Hi!
    > 
    >    Fingerprinting a TCP stack seems a fairly well understood technique
    >    by
    > now, and there are several tools, more or less developed, for
    > the task: nmap, ring, ICMP-based techniques, etc.
    > 
    >    A recent glance over the output from a dozen different finger
    > servers suggests that fingerprinting might be done fairly well on
    > application level, too, although possibly not always as exactly as
    > for TCP/IP-based techniques: applications are easier to move around
    > than TCP stacks are.
    > 
    >    Have there been any attempts to explore this area further?
    > I've googled around, but not found anything obvious, except
    > for observations of some fingerprints, such as responses to
    > DNS SERVER_STATUS_REQUEST (a few respond with something else
    > than 'not implemented'), and so on.
    > 
    > -- 
    > Anders Thulin   anders.thulinat_private   040-661 50 63	
    > Ki Consulting AB, Box 85, SE-201 20 Malmö, Sweden
    > 
    > 
    > ---------------------------------------------------------------------
    > ------- This list is provided by the SecurityFocus Security
    > Intelligence Alert (SIA) Service. For more information on
    > SecurityFocus' SIA service which automatically alerts you to the
    > latest security vulnerabilities please see:
    > https://alerts.securityfocus.com/
    > 
    > 
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
    Service. For more information on SecurityFocus' SIA service which
    automatically alerts you to the latest security vulnerabilities please see:
    https://alerts.securityfocus.com/
    



    This archive was generated by hypermail 2b30 : Tue Feb 04 2003 - 10:57:13 PST