RE: Block OS Detection

Hi,

Some (expensive) commercial firewalls have some protection mechanisms in
place.
In general, a statefull firewall, will stop a bunch of NMAP probes as well
as most ICMP tricks.
Some firewalls have SYN, IP TLL and ID randomization features on board.

Regards



-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx] On
Behalf Of Gadi Evron
Sent: Sunday, September 02, 2007 11:04 PM
To: Ofer Shezaf
Cc: Attari Attari; pen-test@xxxxxxxxxxxxxxxxx;
pen-test-return-1078485025@xxxxxxxxxxxxxxxxx
Subject: RE: Block OS Detection

On Sun, 2 Sep 2007, Ofer Shezaf wrote:
Reverse proxy? So at least for web servers you have a simple solution.
You might be able to reverse proxy few other protocols.

~ Ofer Shezaf

Overwriting values is not going to stop many of the different detection
methods. As mentioned - just one thingie.

Me? I just change banners.



-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx
[mailto:listbounce@xxxxxxxxxxxxxxxxx] On Behalf Of Gadi Evron
Sent: Saturday, September 01, 2007 11:08 AM
To: Attari Attari
Cc: pen-test@xxxxxxxxxxxxxxxxx; pen-test-return-
1078485025@xxxxxxxxxxxxxxxxx
Subject: Re: Block OS Detection

Not everything is good, but you can overwrite different packet values
using.. a firewall for example.

Just one thingie.


On Fri, 31 Aug 2007, Attari Attari wrote:

Hello All:

Is there a PRACTICAL solution from PRODUCTION
environments that can be used to block OS detection
from tools like NMAP? I googled and read some notes
but couldn't find a real world solution to blocking
Windows & Linux OS detection.

I'm quite sure I'll get the right inputs here.

Thank you.

Attari


Unlimited freedom, unlimited storage. Get it now, on
http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html/


---------------------------------------------------------------------
---
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads

---------------------------------------------------------------------
---



-----------------------------------------------------------------------
-
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads

-----------------------------------------------------------------------
-



------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • RE: Block OS Detection
    ... On Sun, 2 Sep 2007, Ofer Shezaf wrote: ... Overwriting values is not going to stop many of the different detection methods. ... buy it or download a solution FREE today! ...
    (Pen-Test)
  • Re: Agnitum Outpost blocking everything
    ... the faulty logic of trusting sw firewalls to alert to Trojans. ... I have Sygate installed and rarely use it. ... methods of detection, including a intrusion detection module for the clueless. ... Their version 6 KIS (Kaspersky Internet Security) requires the fastest PC available so as to not choke it to death. ...
    (alt.comp.anti-virus)
  • Re: Are Fragmentation Attacks Still Used for IDS/IPS Evasion?
    ... I was just reading up on fragmentation attacks using ... since almost all firewalls both ... buy it or download a solution FREE today! ...
    (Pen-Test)