[TOOL] SinFP - A New Approach to OS Fingerprinting

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



SinFP - A New Approach to OS Fingerprinting
------------------------------------------------------------------------


SUMMARY



DETAILS

SinFP is a new approach to OS fingerprinting, which bypasses limitations
that nmap has.

Nmap approaches to fingerprinting as shown to be efficient for years.
Nowadays, with the omni-presence of stateful filtering devices, PAT/NAT
configurations and emerging packet normalization, its approach to OS
fingerprinting is soon to be obsolete.

SinFP uses the aforementioned limitations as a basis for tests to be
obsolutely avoided in used frames to identify accurately the remote
operating system. That is, it only requires one open TCP port, sends only
fully standard TCP packets, and limits the number of tests to 2 or 3 (with
only 1 test giving the OS reliably in most cases).

Features list:
- full OS fingerprinting suite, built as a Perl module
- active fingerprinting
- passive fingerprinting (with signature matching made against active
ones)
- works the same over IPv4 and IPv6 (yes, IPv6 fingerprinting)
- online mode
- offline mode (especially useful when you have a pcap file)
- heuristic matching algorithm to avoid the need to write new signature
for a target stack which has some TCP option deactivated, or changed
window size, for example

Download:
<http://www.gomor.org/files/SinFP-1.01-3.tar.gz>
http://www.gomor.org/files/SinFP-1.01-3.tar.gz


ADDITIONAL INFORMATION

The information has been provided by <mailto:fd@xxxxxxxxx> GomoR.
To keep updated with the tool visit the project's homepage at:
<http://www.gomor.org/sinfp> http://www.gomor.org/sinfp



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [TOOL] httprecon - Advanced Web Server Fingerprinting
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... header-ordering several other fingerprinting mechanisms were introduced. ... Very long GET request ...
    (Securiteam)
  • [TOOL] Cisco Torch - Mass Cisco Vulnerability Scanner
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... In the process of writing "Hacking Exposed Cisco Networks" Andrew got ... telnet fingerprinting database) are borrowed from Hackbot - thank you guys ... services and launch dictionary attacks against the services discovered. ...
    (Securiteam)
  • [TOOL] Fast SYN Scanner (libnet, libpcap)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... struct bpf_program cfilter; ... const unsigned char *packet; ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • [NT] NetFile FTP Denial of Service (Nonexisting Username)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... multi-threaded FTP/HTTP server combined, featuring automatic virtual ... * Net File version 6.5.1 and prior ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • [TOOL] P0f - Passive OS Fingerprinting Tool
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Machines that connect to your box, ... Official SYN+ACK fingerprinting support ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)