Gaining information about current version of an application or operating system in order to find a vulnerability.

learn more… | top users | synonyms

1
vote
1answer
17 views

What TCP-level commands affect the global configuration of the stack?

I'm looking at TCP, and what options may affect the global configuration so that I can detect a repeat visitor. What TCP commands (for lack of a better word) affect the global TCP stack? Or that or ...
0
votes
2answers
49 views

Browser Fingerprinting and Passwords stored by browser

I am using the Firefox browser on a Linux system and it came to my knowledge that it is possible for sites to take a fingerprint of the user visiting their homepages. So I actually have four ...
0
votes
0answers
39 views

Can a TPM's EK's public key (hash) be used to fingerprint a device?

The question How to use TPM to perform platform authentication is basically asking if the TPM's EK can be used to "authenticate" a host/device. And one of the answers says The Endorsement Key ...
2
votes
1answer
123 views

Is an SSL/TLS HTTPS certificate 'fingerprinting' attack possible?

If you download a friend's site's unique HTTPS root certificate (independent of default browser-shipped ones), or you simply make a 'permanent exception' to an obscure self-signed cert, in Firefox, I ...
2
votes
1answer
187 views

Does HTTPS protect you from fingerprinting by the NSA?

We've established that, for all intents and purposes, HTTPS hides what page you visit on a given server from NSA backbone wiretapping, but not the domain itself. But that's only IP / domain ...
0
votes
1answer
161 views

Using OpenAppID without Snort [closed]

Cisco Security introduced open source application detection and control mechanism which called "OpenAppID". Which can be checked in the link Lets say I have a sniffer application for myself; if I ...
1
vote
2answers
386 views

How to fake a browser fingerprint?

I'm developing a browser based on Google Chromium and keeping in mind that privacy is freedom; but I need to know how to protect my browser's users against fingerprinting. I was thinking about ...
11
votes
5answers
2k views

Are photographs of fingerprints a security risk?

It should be trivial to get fingerprint patterns for many of the most important people in the world, as they frequently (enough) wave their hand, palms forward, to many HD cameras. Is it possible to ...
3
votes
4answers
1k views

bot detection via browser fingerprinting

I've recently noticed that a few companies have begun to offer bot and scraping protection services based on the idea of browser fingerprinting to detect them, and then blocking the specific ...
1
vote
1answer
134 views

DPI BitTorrent fingerprinting

For limiting the usage of BitTorrent, I must identify BitTorrent traffic. For handshaking, I am simply looking for "19" and "BitTorrent protocol" string. If it is DHT I am looking for ping or id ...
0
votes
1answer
57 views

Throttle network based on OS [closed]

What do I need to learn/know to throttle a clients network based on his/her operating system. For example: Someone in my network using Kali Linux... I would like to throttle their traffic to ...
1
vote
1answer
76 views

Can we build network topology using passive fingerprinting?

Can we use the tools such as P0f, OSSIM and other passive fingerprinting tools to build a comprehensive network topology of how the devices are interconnected ? or is there a passive finger printing ...
9
votes
4answers
68 views

Fingerprinting the webpage content

I'm moderating a closed section of a forum - think 'covered by NDA' (not actually, but it's a good equivalent of the situation), with restricted access. Sometimes we find screenshots from that forum ...
1
vote
2answers
219 views

Are Internet Explorers “Tracking Protection” able to prevent AddThis canvas fingerprinting?

A paper on web tracking mechanisms identifies the web-tracking company AddThis as a major user of canvas fingerprinting. Are IE:s Tracking Protection, provided Tracking Protection Lists including ...
6
votes
1answer
607 views

How is YouTube able to identify anonymous users?

A few days ago I was searching YouTube and I noticed an "outlier" video poped up in the suggestions list. This video had nothing to do with the topic being searched, but instead it was based on a ...
0
votes
1answer
201 views

Virtualization / Cloud-Stack fingerprinting from running VM

How can the host environment (not just the OS) be identified from a running guest VM. To determine what the underlying host and virtualization stacks being used actually are. I.e. whether there's a ...
1
vote
2answers
328 views

How to detect Snort on the network?

Does anyone know how to fingerprint an IPS ? is there any tool available to do the job? I want to detect snort in my network . Would appreciate any kind of help.
1
vote
1answer
102 views

Botnet fingerprinting

Does anyone know of any research of papers on fingerprinting botnets? If a given target is being brute forced or DDoSed do methods exist to determine if a brute force or DDoS on another target are ...
1
vote
0answers
60 views

Matching vulnerabilities with upstream versions

How am I supposed to match vulnerabilities with services fingerprint, with string like these? Is there a public database to match these versions with original versions? > 5.5.29-0ubuntu0.12.04.1 ...
0
votes
1answer
80 views

Service banner checking for vulnerabilities offline

Has anybody seen a tool where you can collect Service banners from something like nmap, output them to a file, the vuln vulnerability checks offline?
5
votes
1answer
3k views

Discovering a vulnerable service on a machine

I am trying to get access to one of the machines in my lab. it has 2 tcp ports that I am highly suspecting which are: port 25 tcp port 111 tcp For port 25, it is supposed to be running SMTP, ...
-4
votes
2answers
512 views

Defend against HTTP fingerprinting [closed]

I'm looking for ways to defend against common fingerprinting techniques used by hackers to identify what kind of setup my website is running on. I understand this is a complicated topic, and every ...
1
vote
1answer
687 views

Spoofing OS during browsing

I am using http://www.mybrowserinfo.com/ to gather some info about me while browsing. I want to change my OS to appear that its a Windows Xp machine.(No VM solutions please:D) If you have any ...
0
votes
1answer
638 views

Does google use browser fingerprinting? [closed]

I'm wondering whether besides collecting the typical tracking information (IP + cookies) google has already implemented browser fingerprinting? I read sometime not long ago about it being a ...
1
vote
1answer
119 views

How can I block flash from obtaining a list of available fonts in my browser? [closed]

How can I block Flash, at least in Chrome, from obtaining the list of available fonts in my browser? It seems that the combination of fonts available is the easiest way to fingerprint a browser.
8
votes
1answer
691 views

Can BitTorrent clients be fingerprinted?

As https://panopticlick.eff.org/ demonstrates, web browsers are very prone to fingerprinting, both active and passive (often you can fingerprint a web browser by simply monitoring the wire). My ...
6
votes
3answers
5k views

How to know if two IP addresses point to the same web server?

Doing some testing against two IP address in the scope I find one web server in each one. Both host what it seems the same web application. They are different public (accessible through Internet) IP ...
4
votes
1answer
953 views

Techniques for fingerprinting a web based content management system (CMS)

Let's say we have a random basic blog or informational website: just some pages with information, a sidebar with an overview of the archives, the normal stuff. We know of this website that it's built ...