Questions tagged [fingerprinting]

Gaining information about current version of an application or operating system in order to find a vulnerability.

Filter by
Sorted by
Tagged with
0 votes
0 answers
39 views

Which system variables are exposed from browser JavaScript context?

I know that the TZ variable aka TimeZone can be read by servers, especially with fingerprinting. What are the exposed variables to browser's ?
Gilles Quénot's user avatar
1 vote
1 answer
117 views

Since yt-dlp simulates a browser, can it be fingerprinted in the same ways (e.g. canvas and audiocontext)?

I know that wget and curl can mitigate fingerprinting (aside from http header and user agent), but will yt-dlp give away more data?
BigAl's user avatar
  • 11
0 votes
1 answer
243 views

How does reddit maintain visit history after clearing cache, cookies and de-fingerprinting?

Setup: I clear cache and history in firefox, then visit reddit.com in a private window and browse/read three very specific subreddits while NOT logged in. Then, I close that private window entirely ...
user227963's user avatar
3 votes
1 answer
2k views

Is there any secure way to make sure that a request comes from a browser and via a specific domain (by just using frontend)?

Let us assume that we have a public API, for example, company.com/publicEndpoint, that can accept requests from any source. Various websites, like foo.com and bar.com, use JavaScripts that call this ...
John's user avatar
  • 31
0 votes
1 answer
71 views

TLS Private Key Secured with Hardware Fingerprint

I worked for a company where our TLS Private Key was accidentally leaked to the Internet and it was a big mess. The strategy the security team came up for avoiding this in the future was "be more ...
Charlie's user avatar
  • 125
1 vote
1 answer
104 views

How can websites fingerprint the company I work for?

During my work day, I came upon a website that had a popup that identified the company I work for(basically saying "contact us X company"). This website was never previously visited, cookies ...
Joe's user avatar
  • 11
1 vote
1 answer
396 views

How do you hide your browser advertising fingerprint?

How do you hide your browser finger print from advertising networks without disabling javascript? Is there a browser extension that can help mask unique browser fingerprint? Browser finger print can ...
Christian's user avatar
  • 265
5 votes
1 answer
140 views

Possible to avoid device fingerprinting with imagemagick?

If I took a picture with my mobile phone and wanted to publish that photo without any artefacts connect to me, the first thing I would do is strip all of the image metadata with 'exiftool': exiftool -...
user227963's user avatar
0 votes
1 answer
303 views

DNS Enumeration by IP Address

I know all baseline steps to do DNS enumeration over a domain. But my questions is: how can I enumerate a server when I do not know which domain it is managing and I only have its IP address? My ...
Mr John's user avatar
1 vote
1 answer
213 views

How to hide PC characteristics on the internet from tools like NMAP etc [closed]

Is there a way to disguise your PC characteristics from tools like NMAP and others on the internet? For instance if the OS you are using is Ubuntu is there a way to make it show up as something else. ...
Rideboards's user avatar
1 vote
0 answers
174 views

GPU vs integrated graphics hardware, browser canvas fingerprinting, and multi- or dual-boot systems

My goal is to ensure that two operating systems installed side-by-side on the same device are unable to return the same canvas fingerprint, when a modern browser is allowed to run javascript without ...
brynk's user avatar
  • 1,071
0 votes
1 answer
1k views

How to resist JA3 fingerprinting while browsing using common browsers (e.g. Firefox, Chrome, etc)

Background. Context. I use Firefox, Google Chrome, or Chromium on Linux. Question. How to have my browser resist the JA3 fingerprint, so that sites don't identify me by it? Thoughts. I guess it may ...
caveman's user avatar
  • 142
0 votes
1 answer
453 views

Fingerprinting Cisco ASA Device

I have used Nessus to determine that a client's Cisco ASA is vulnerable to a Read-Only Path Traversal Vulnerability. So far I have tried viewing the logon portal page source code, nmap -sV -A <host&...
jh2014's user avatar
  • 3
1 vote
1 answer
691 views

How could I know if a website is fingerprinting you via WebGL?

I would like to know if a website is fingerprinting me via WebGL, first of all, knowing if the site is doing it Knowing when they send the request to my browser Knowing what value I am reporting to ...
The Dan's user avatar
  • 111
-3 votes
2 answers
217 views

Number of biometric samples required to form an exhaustive set of fingerprint hashes?

Number of biometric samples required to form an exhaustive set of fingerprint hashes? Slight variations in the sample produce different hash values of the sample data. The answer linked below ...
polcott's user avatar
  • 93
2 votes
3 answers
1k views

Application to detect SSL certificate fingerprint differences

My project is to find out how to detect HTTPS interception/mitm and create some sort of application using detection techniques. One of the ways I was thinking of is a active desktop application to ...
LtMuffin's user avatar
  • 452
0 votes
0 answers
62 views

How do I assure that a site that I visit does not know I have been there before? [duplicate]

If I use the same machine (my PC) but with a different IP address and a different browser that I have never used to visit a site, will that site still be able to identify me? I don't understand the ...
Sam Branner's user avatar
1 vote
2 answers
480 views

Can a fingerprint be reconstructed from a device that uses it for authentication?

I've noticed a lot of phones (not to mention, other devices) have built in fingerprint sensors these days. Do these devices store information in such a way that your fingerprint could be reconstructed ...
user1833028's user avatar
0 votes
0 answers
315 views

Why does my IP being leaked with system-wide proxy through webTRC, but it doesn't happen when I use system-wide VPN

WebRTC manages to leak my IP when I use proxy, but when I use VPN it only shows VPN server's IP (both proxy and VPN were system-wide). What's the key difference? Google Chrome was used in both tests (...
infinitieunique's user avatar
0 votes
0 answers
569 views

How to prevent browser fingerprinting accoss VM's whilst remaining natural?

I am using a couple VM's fitted with proxies and find that browser fingerprinting across VM's causes me many issues. I also have issue with the browser created inside VM leaking that I am using VM. ...
reputable2020vision's user avatar
1 vote
0 answers
84 views

Is mutually private protocol negotiation possible?

Say I have two peers that wish to engage in a protocol with multiple sub-protocols. Naturally, it is necessary for them to negotiate which sub-protocol they should use. But what if the peers wish to ...
user244217's user avatar
1 vote
2 answers
188 views

Client Fingerprinting Resistant Protocols

It's well known that web clients are easy to fingerprint, and you can see that the same is true for other protocols like email and BitTorrent. This begs the question: which protocols aren't easy to ...
user244098's user avatar
0 votes
0 answers
398 views

How can you fingerprint a Django web app?

In order to better protect my Django web app, I want to reduce the leakage of information that could help an attacker profile my application. If you were an attacker, what would you look at to ...
Kyle Fennell's user avatar
7 votes
2 answers
541 views

What impact does an installed extension have on the browser fingerprint (uniqueness)?

Motivation I want to develop a custom, local Firefox extension and investigate, if its installation has any impact on the browser fingerprint. Background Some time (years?) ago, there were articles ...
bela53's user avatar
  • 173
1 vote
0 answers
331 views

Do emulator programs like Bluestacks, Memu, Genymotion use the real device settings of the computer you're connecting from?

Many online services use fingerprinting to track users - storing enough hardware and software details to create a unique record. But what do emulators do? Can they make you completely anonymous on the ...
InspWidget's user avatar
0 votes
1 answer
146 views

Tor Browser: Could a website or ISP detect modification to DOM done by users if Javascript is disabled?

I have Tor Browser (which is basically Firefox ESR) on "Safest" setting (Javascript disabled). We're generally scolded about using extensions in it, as they can alter web traffic patterns to ...
stranger's user avatar
  • 101
2 votes
1 answer
517 views

Is javascript fingerprinting becoming obsolete?

Okta recently sent out an email to admins about changes to their new device detection strategy. According to them: Due to browser advancements in anonymous web browsing, JavaScript fingerprinting ...
Indigenuity's user avatar
  • 1,343
4 votes
1 answer
788 views

Effect of Firefox's "Responsive Design Mode" on the browser's fingerprint

Today I switched ON the "Responsive Design Mode" under the "Web Developer" Section of the Firefox menu, and from the dropdown menu selected "iPhone X/XS iOS 12". So now ...
user's user avatar
  • 275
1 vote
1 answer
253 views

Which approach is technically more effective to hinder user tracking - fingerprint generalization or randomization?

Tor's approach to countering fingerprinting is to make as many users "appear the same" as possible. Let us call this "generalization". While Brave tries to randomize all fingerprints of each and every ...
threeeMiaNichole's user avatar
2 votes
2 answers
3k views

nmap script "smb-os-discovery.nse" does not output information about the host OS?

I was following this Lynda course. https://www.linkedin.com/learning/ethical-hacking-enumeration/enumerating-smb-from-linux-episode-1 The instructor used this script to detect the OS of the target ...
Enzio's user avatar
  • 143
0 votes
2 answers
386 views

Can I bypass basic auth to fingerprint a web server with Httprint or netcat? [closed]

There is a web server I'd like to recon using httprint. But that web server has a basic auth protection on 443. Port 80 is not responding. When I launch httprint, it says Unspecified Error The same ...
tommy's user avatar
  • 3
1 vote
2 answers
2k views

How to configure a VM to protect all my hardware fingerprint from guest OS and softwares?

This question was originally Does Firefox in VM have a common enough fingerprint so I don't need tor browser? in Tor community. I want to know about what a web browser's fingerprint like in a VM, ...
Bob Johnson's user avatar
4 votes
0 answers
124 views

How can we protect encrypted files and directories from being fingerprinted when stored on online storage services?

Assuming that online storage providers are considered untrusted, if files and directories are encrypted, how can these be protected against fingerprinting? The files are encrypted using rclone's ...
Ryan's user avatar
  • 93
1 vote
1 answer
183 views

Why fingerprint a browser if a fingerprint can be replayed?

I'm facing an issue with rampant scraping and abuse on a website that costs me a good chunk of money to maintain. So, I have been looking to implement a few solutions, and apparently these solutions ...
user avatar
0 votes
1 answer
188 views

Possible to detect tools like HTran from network analysis?

There is a publicly available tool called HTran which is widely used by criminal groups in cyberattacks to exfiltrate data. It simply relays traffic from one host to another, much like a proxy. It is ...
john doe's user avatar
  • 698
1 vote
3 answers
2k views

How is browsing from a virtual machine/virtual box preventing fingerprinting or tracking?

Does it increase your internet security in terms of privacy/tracking/fingerprinting if you are surfing with your web browser in a virtual machine environment (virtual box + VPN) instead of surfing ...
johnsmiththelird's user avatar
3 votes
2 answers
539 views

Fingerprint FTP services without Banner message

I want to write a python script that is able to fingerprint ports on a server to identify the FTP client running on the port. While there is often a Banner message upon connection, this message is ...
Tom's user avatar
  • 474
1 vote
0 answers
233 views

How do fingerprinting techniques involving Canvas and WebGL work?

Websites can fingerprint a web browser with techniques involving WebGL and HTML5 Canvas. The website like https://amiunique.org/fp shows an example of this. How exactly do these techniques work? I ...
northerner's user avatar
2 votes
0 answers
110 views

Does photo fingerprinting (using metadata) allow to search all photos on internet made by the same user (privacy issue)?

Browser fingerprinting is well-known: since a client gives many HTTP attributes/Javascript attributes during a website visit, the probability that two users have the same exact values for all this ...
Basj's user avatar
  • 963
2 votes
1 answer
3k views

How to change the browser canvas html hash for fingerprinting?

building on this previous post Can canvas hash be used to track me and ruin my anonymity? I want to ask: Is there any way a user can affect this canvas html hash generation, a way to make the hash ...
johnsmiththelird's user avatar
4 votes
1 answer
2k views

Can canvas hash be used to track me and ruin my anonymity?

I have heard there is a fingerprinting method that traces internet users based on browser data. I believe it is called "canvas HTML hash". This hash is unique, as I understand? Or does it ...
johnsmiththelird's user avatar
40 votes
5 answers
8k views

Why do some web servers still provide information on vendor and version in the HTTP response headers

I think in the security field it is a well-known fact that its not a good idea to let the web server vendor (e.g. Apache) and the version be visible to the outside as this can be used to launch ...
dfsg76's user avatar
  • 549
0 votes
0 answers
718 views

How to fingerprint Windows 10 reliably?

Recently, I have been practicing penetration testing and I have come to a standstill when trying to fingerprint the OS for a Windows 10 target with nmap. For the most part, I'm not able to identify ...
rodney williams's user avatar
-2 votes
2 answers
1k views

Antivirus and malware fingerprints

I´m a student in IT security and I would like to know how the malware fingerprints work in common AntiVirus. I understand that when a malware is detected it's because the binary fingerprint is known ...
dudule's user avatar
  • 1
1 vote
3 answers
292 views

Do I have to do any setup if I want to run a VPN with the Tor browser bundle?

I know there will be some votes against this but I want to run a VPN alongside the Tor browser. Can I just open the VPN program, connect to the VPN provider, then open the Tor browser and use it as ...
Ultra Gamer's user avatar
0 votes
1 answer
160 views

Fingerprinting Windows Architecture from a file on remote system

This is a post following up with this one. Similar situation as the above post - I'd like to know if there's a way to find out the architecture (x86 or x64) of a windows system from a file on a ...
Izy-'s user avatar
  • 873
1 vote
0 answers
161 views

Is perceptual hashing feasible to identify users [closed]

I have been shadow-banned on an app (Tinder) and I cannot get around it. I have been doing some background research into how they are able to identify me and have come across device fingerprinting (I ...
Lee's user avatar
  • 227
8 votes
1 answer
1k views

Will two smartphones (identical hardware and software) generate the same canvas fingerprint?

When using Canvas Fingerprint (like on this website) to distinguish users, does two smartphones (same model, same OS version, and no browser/plugin customization) will share the same fingerprint?
Matthieu Charbonnier's user avatar
2 votes
0 answers
444 views

How to defend against adblock detection/adblock subscription leaks?

Is there a best practice (or useful extension) for defending against adblock fingerprinting techniques? I'm not asking about how to bypass adblock detection as such, but rather how one might appear ...
Lichtung's user avatar
1 vote
1 answer
507 views

How os fingerprinting works and how to prevent it in browser? [duplicate]

For privacy I always changed my useragent of browser regularly and it used to work. But lately changing useragent alone in browser dosen't prevent os fingerprinting. Tools like https://browserleaks....
Eka's user avatar
  • 569