xprobe 0.2

From: nobody (pentester@yahoo.com)
Date: 10/26/01 

Message-ID: <20011026142550.23172.qmail@web12008.mail.yahoo.com>
Date: Fri, 26 Oct 2001 07:25:50 -0700 (PDT)
From: nobody <pentester@yahoo.com>
Subject: xprobe  0.2
To: pen-test@securityfocus.com

All,

the new xprobe 0.2 works well - as far as it goes.
But - does anyone know if there is sufficient
difference between the tcp/ip signature of an NT
WORKSTATION and an NT SERVER OS.

Problem:

I need to (without making a windows connection via SMB
using pgms like gettype, winmsd, winffingerprint
etc..)
determine which Windows machines are running NTSERVER
OS.

Does anyone know or think the the tcp/udp packet
response from the NT SERVER will be different enough
from the NT WORKSTATION - so that I can tell them
apart. again - i cannot use the normal windows
connections to do this (no port 139 connections).

If there are any difference in the packet response -
then I could add an NT SERVER (does not matter if it
is NT or W2K) to the signature file for xprobe 0.3 ??

any help ?

thanks

__________________________________________________
Do You Yahoo!?
Make a great connection at Yahoo! Personals.
http://personals.yahoo.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/

Relevant Pages

  • Re: Any reasons to filter ARP packets?
    ... it can make a good article on securityfocus or a similar site. ... you can not only intercept ... As a funny attack, you could ... can decrypt almost _any_ encrypted connection. ...
    (comp.os.linux.security)
  • Re: command-line reverse connection tunnel?
    ... I wrote a suite of Tcl scripts to accomplish this goal a few years ago, it has been listed on SecurityFocus for a long time as reverseutils. ... >have a machine behind a firewall that lets in only port 80, ... I need a program on SERVER1 that creates a connection to ... and SERVER1 needs to connect to itself on port 3389. ...
    (Pen-Test)
  • command-line reverse connection tunnel?
    ... have a machine behind a firewall that lets in only port 80, ... I need a program on SERVER1 that creates a connection to ... and SERVER1 needs to connect to itself on port 3389. ... This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)
  • RE: Serial Connection Password Cracker.
    ... This is a tcp socket server that redirects all I/O to a serial port. ... > Subject: Re: Serial Connection Password Cracker. ... >> This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • Arescom NetDSL 800
    ... The Arescom NetDSL 800, by default has no configurated any kind of ... ADSL connection, or using for its own porpouses ... This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)