3

Recently I did an nmap service scan against a list of domains and one of the NSE scripts running was fingerprint-strings.

This script apparently extracts ASCII strings from unidentified services.

Since the domains are web-servers and the port is 443 the fingerprints strings responds with http or html. And one of the outputs is below:

DNSStatusRequest, DNSVersionBindReq, Help, Kerberos, RPCCheck, SMBProgNeg, SSLSessionReq, TLSSessionReq: 

HTTP/1.1 400 Bad Request
Server: awselb/2.0
Date: Thu, 01 Mar 2018 11:02:47 GMT
Content-Type: text/html
Content-Length: 138
Connection: close
<html>
<head><title>400 Bad Request</title></head>
<body bgcolor="white">
<center><h1>400 Bad Request</h1></center>
</body>
</html>

FourOhFourRequest, GetRequest, HTTPOptions: 

HTTP/1.1 404 
Date: Thu, 01 Mar 2018 11:02:40 GMT
Content-Length: 0
Connection: close

JavaRMI, NCP, NotesRPC, TerminalServer, WMSRequest, oracle-tns: 

HTTP/1.1 400 Bad Request
Server: awselb/2.0
Date: Thu, 01 Mar 2018 11:02:49 GMT
Content-Type: text/html
Content-Length: 138
Connection: close
<html>
<head><title>400 Bad Request</title></head>
<body bgcolor="white">
<center><h1>400 Bad Request</h1></center>
</body>
</html>

LANDesk-RC, LDAPBindReq, LDAPSearchReq, LPDString, SIPOptions, X11Probe: 

HTTP/1.1 400 Bad Request
Server: awselb/2.0
Date: Thu, 01 Mar 2018 11:02:48 GMT
Content-Type: text/html
Content-Length: 138
Connection: close
<html>
<head><title>400 Bad Request</title></head>
<body bgcolor="white">
<center><h1>400 Bad Request</h1></center>
</body>
</html>

RTSPRequest: 

<html>
<head><title>400 Bad Request</title></head>
<body bgcolor="white">
<center><h1>400 Bad Request</h1></center>
</body>
</html>

afp, giop: 

HTTP/1.1 400 Bad Request
Server: awselb/2.0
Date: Thu, 01 Mar 2018 11:02:50 GMT
Content-Type: text/html
Content-Length: 138
Connection: close
<html>  
<head><title>400 Bad Request</title></head>
<body bgcolor="white">
<center><h1>400 Bad Request</h1></center>
</body>
</html>

tor-versions: 

HTTP/1.1 400 Bad Request
Server: awselb/2.0
Date: Thu, 01 Mar 2018 11:02:40 GMT
Content-Type: text/html
Content-Length: 138
Connection: close
<html>
<head><title>400 Bad Request</title></head>
<body bgcolor="white">
<center><h1>400 Bad Request</h1></center>
</body>
</html>

I've gathered a couple of fingerprint-strings output from the domains and not all of them has tor within it.

Basically I'm wondering is this confirmation that a hidden service is running on this domain, or is there another test or nmap scan I can run to confirm this? If it's not confirmation, then why am I getting this output.

Improve this question
1
  • 3
    It's pretty obvious you've discovered an Amazon Elastic Load Balancer, not a Tor hidden service.
    – Michael Hampton
    Commented Mar 6, 2018 at 22:38

3 Answers 3

Reset to default
5

A hidden service doesn't use any special ports, protocols etc. It's just a normal web server which usually isn't accessible over the public-facing network interface and is accessed over a locally running Tor instance.

Properly configured Tor hidden services which don't want to be reachable over the clearnet only listen on the loopback interface of the server and have the locally running tor service connect to them. So you can't figure out whether there is a hidden service running on a machine with nmap.

There are a few ways to test a hypothesis whether a given server hosts a tor hidden service. A simple one is to measure the uptime of the server and the uptime of the hidden service over long periods of time and look for a strong correlation of the two. If they both go down at the same time, that's a strong hint. Another possibility is to stress the server and then measure whether performance drops for the hidden service (but don't do this! this might be seen as an attack by server administrators). If done repeatedly, it might confirm the hidden service is running on the server in question.

Fingerprinting open ports, OTOH, won't give you any information about the presence of a hidden service.

Improve this answer
3

The fingerprint-strings NSE script shows the readable ASCII strings from service responses to Nmap's probes; the headings like tor-versions, RTSPRequest, and afp, giop are the names of those probes, not responses from the target service.

I just wrote a little more explanation in the NSEdoc for that script, so hopefully this won't be as confusing in the future.

P.S. A web search for "awselb" leads me to believe this is Amazon Web Services Elastic Load Balancing.

Improve this answer
0
1

There is no way to tell whether a web server is also reachable over a HS. A Hidden Service functions as a proxy to reach a web server, but the web server can be left unchanged. Because nothing needs to be changed, there is no change to be observed.

I don't know where the "tor-versions" string from your screenshot comes from. I don't see anything in the headers or body that hints at it being accessible through a HS.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .