Re: Fingerprinting Firewall

From: Fatih OZAVCI (fatih.ozavci_at_infosecurenet.com)
Date: 04/13/05

  • Next message: Lynx: "Re: Any way to automatically change arbitrary headers of IP packets on-the-fly?" 
    Date: Wed, 13 Apr 2005 10:18:24 +0300
To: Prashant Gawade <prashant.gawade@paladion.net>

    hi,

    some firewalls (like checkpoint fw-1) have by-default open services, you
    can detect firewall if this services or ports are open.

    for example 256/18264/264 ports are open, this firewall is checkpoint fw-1.

    also you can analyze tcp/ip fingerprints for firewall operation system
    (*bsd, linux, solaris etc.)

    good luck.

    Fatih Ozavci
    IT Security Consultant

    Prashant Gawade wrote:
    >
    > hi
    >
    > We all know that, we can identify firewall using various methods and tools like "firewalk".
    > Is there any method or tool available which will remotely fingerprint and enumerate rule base configured on the firewall?
    >
    >
    > Prashant Vijayanand Gawade
    > Paladion Networks
    > Security Engineer
    > Navi- Mumbai
    >

  • Next message: Lynx: "Re: Any way to automatically change arbitrary headers of IP packets on-the-fly?"

    Relevant Pages

    • Re: Trouble accessing Outlook Web Access from behind firewall
      ... When starting the firewall I also set ... > rejected and dropped packets are logged, however I see nothing in my log ... > # Higher ports needed to accept incoming/outgoing calls ...
      (comp.security.firewalls)
    • Re: iptables configuration
      ... >> that if a 'virus/trojan' initiated a connection to the net, the firewall ... >> would not protect the LAN. ... The LAN is NATed with private IPs to one public IP. ... the ports that are used by services running on linux. ...
      (comp.os.linux.security)
    • Re: Norton Personal Firewall 2003
      ... |> First thing I would do is put the GRC test site into the Exclusions ... | ports they will not get the same result being in my blocklist, ... the firewall checks unsolicited inbound communications attempts. ...
      (comp.security.firewalls)
    • Re: NetBios Names and SP2
      ... This will tell you which ports are open in the firewall as well as some ... Run the command (note: you must have the Support Tools from the Windows ... Check that "Enable NetBIOS over TCP/IP" is selected in the network ...
      (microsoft.public.windowsxp.network_web)
    • Re: What is broken:McAfeee firewall or my router ????? Urgent, ple
      ... your computer regardless of what McAfee firewall said. ... If your router is ... warned about those ports being available right away if you had any of those ...
      (microsoft.public.security)