Questions tagged [fingerprinting]
Gaining information about current version of an application or operating system in order to find a vulnerability.
6
votes
1answer
191 views
Will two smartphones (identical hardware and software) generate the same canvas fingerprint?
When using Canvas Fingerprint (like on this website) to distinguish users, does two smartphones (same model, same OS version, and no browser/plugin customization) will share the same fingerprint?
0
votes
1answer
44 views
How to defend against adblock detection/adblock subscription leaks?
Is there a best practice (or useful extension) for defending against adblock fingerprinting techniques? I'm not asking about how to bypass adblock detection as such, but rather how one might appear ...
0
votes
1answer
81 views
How os fingerprinting works and how to prevent it in browser? [duplicate]
For privacy I always changed my useragent of browser regularly and it used to work. But lately changing useragent alone in browser dosen't prevent os fingerprinting. Tools like https://browserleaks....
2
votes
1answer
97 views
How to mitigate the consequences of being tracked by fingerprint2.js?
A webpage of a bank, where I get redirected to make a payment for my ticket, uses fingerprint2.js. The webpage doesn't work at all when I'm using AdBlock extension in my browser and fingerprint2.js ...
1
vote
2answers
165 views
How does Cloudflare track their client? Tor is not a workaround
I mirrored a ecommerce site using wget. This site seems to use Cloudflare to handle their web traffic.
What's interesting is that after 90 % or so of the mirroring was done, wget started to produce/...
3
votes
1answer
115 views
Is there a way to find out what information website queries about us? [closed]
What tool or software should I look for to find out what "fingerprinting" data
a website is tracking?
Like, I want to know, if website looks for a cache and/or fonts installed in system, or Canval, ...
3
votes
1answer
157 views
Will disabling WebGL make me more or less unique on the internet?
I have wondered whether disabling WebGL will make me more or less unique, I fiddled around with https://panopticlick.eff.org/ to see what would happen.
If I keep it enabled I am 1/205.66, with me ...
0
votes
1answer
65 views
What is ScriptSafe's “Client Rectangles” and what information does it leak?
Just wondering how this one affects the privacy and security because it breaks a lot of sites displaying images for example.
-1
votes
2answers
205 views
Does multi-factor authentication make tracking/fingerprinting easier?
Is multi-factor authentication a privacy risk? Does it make tracking/fingerprinting easier?
It was seem so because whoever is accepting the OTP could track and record every OTP request and metadata ...
5
votes
2answers
244 views
What “timing attacks” could websites perform using last modified dates of files?
https://developer.mozilla.org/en-US/docs/Web/API/File/lastModified describes the .lastModified property of a File object in JavaScript (usually created when a user selects a file via a HTML <input ...
1
vote
0answers
59 views
How can I fingerprint Yii framework version?
I am currently testing in a black box manner an application written in Yii framework.
How can I fingerprint Yii framework exact version? It's there a public file or function that I can use to perform ...
2
votes
1answer
150 views
How can Telegram find my phone number on iOS 11 after uninstall?
I wanted to sign in Telegram on my iPod Touch running iOS 11 with another account.
I deleted the app and install it again. On the sign up screen Telegram filled the phone number field with the number ...
1
vote
1answer
334 views
How reliable is using Fingerprint sensor (iPhone/Android) for identity approval?
What I'm trying to achieve is a confirmation of transaction (not payment) with a fingerprint sensor. Pretty much like Google does in its Play store:
Chose a product, click pay
Approve your choice ...
0
votes
1answer
88 views
Re-run nmap OS fingerprint match with existing subject fingerprint
I have a collection of nmap subject fingerprints (described here), but have updated my local (private) reference fingerprint database since they were collected. Is there any existing way to re-match ...
1
vote
0answers
165 views
Digital Camera Fingerprinting via Instagram and Snapchat
I was going through one of the articles on camera fingerprinting that says that
using most basic Instagram or Snapchat filters will not get rid of the
camera fingerprint. However, changing the ...
2
votes
1answer
99 views
How does a keypair fingerprint work?
Setting up an AWS instance with the instructions here, I create a public/private keypair. I understand the public key fingerprint is usually just a hash of the public key.
However, the instructions ...
10
votes
2answers
833 views
How do exploit kits enumerate or fingerprint their targets?
My current understanding is that an exploit kit will fingerprint (gather information on) a system, check those details against a database of vulnerabilities and then attempt to use the relevant ...
2
votes
1answer
449 views
methods to check https certificates
I have a basic question regarding fingerprints of https certificates, the specific case I wanted to check being my online banking service. With firefox on linux, I can visit the specific web page and ...
1
vote
0answers
89 views
Can websites collect browser data without using http requests? [closed]
Is it possible for a website to collect data such as the plugins/fonts installed without sending it thought http requests?
If so, is there any plugin for any browser that tells the user what type of ...
1
vote
0answers
46 views
Flow watermarking / fingerprinting
It is known that flows can quite easily be fingerprinted and watermarked [1] (usually observing or adding jitter to packets). Let's say someone added a watermark to my flow which then passes through a ...
0
votes
1answer
199 views
WAFDetect Extension of Burpsuite
I am creating a list of tools for waf fingerprinting.
I have installed waf-detect plugin from bapp store in burpsuite.
This plugin runs in the background and create passive scanner issues when WAF ...
0
votes
1answer
36 views
Process of finding device hostnames on LAN
Is there a reliable way to retrieve hostnames from LAN devices without having to install extra software or performing nmap-style OS fingerprinting?
I'm ideally looking for either a protocol that has ...
4
votes
2answers
437 views
Why do browsers expose installed fonts?
It's a well known fact (in the privacy-aware community, at least), that a factor quite used for tracking is the list of installed fonts, which browsers seem to expose, and trackers exploit this.
...
1
vote
1answer
239 views
How are Google always identifying me? [closed]
I'm trying to create multiple Google accounts
Here's my setup:
I use Firefox with the FoxyProxy plugin and a bunch of IP's.
I use the Firefox Random Agent Spoofer plugin, with the following ...
1
vote
1answer
101 views
Correlation between server request and response time and built-in php functions
Is there any way to identify which built-in PHP function is used in some given script only by sending a request and receiving a response from the remote server?
To keep it simple we might assume that ...
12
votes
1answer
838 views
Guessing PHP version and info from phpinfo using black box analysis
Intro
I'm currently experimenting with PHP black box analysis and couldn't find any useful information. There are some approaches how to determine e.g. Apache version, but for PHP it seems that ...
1
vote
2answers
201 views
WAF - How to tell what automated tool is causing alerts
When a WAF is throwing alerts your way is there a tool or way to fingerprint the the script or automated tool the potential attacker is using against the site?
What techniques can I use to narrow ...
1
vote
0answers
62 views
spoof OS name in ubuntu for nmap scans [duplicate]
How can I spoof the OS CPE that is reported by nmap?
This is my CPE: OS CPE: cpe:/o:linux:linux_kernel:3 when scanning with nmap leakage all my OS properties. But I need to change the original ...
1
vote
1answer
103 views
How can one avoid having their online presence traced back to an identifiable network?
I've been reading up on browser fingerprinting and device identification. Today I'd like to focus on the network side of things.
Assuming I was interacting with a website on multiple occasions, but ...
4
votes
2answers
418 views
Fingerprinting servers behind firewall
I am currently testing some servers that are present behind a firewall. During the scanning I am unable identify which ports are open except port 80.
I have used various switches for Nmap only -Pn ...
2
votes
2answers
382 views
What's the best way to salt a useragent string?
What would be the best way to salt a periodically changing useragent string, so as to avert browser fingerprinting?
For example, a useragent string like this:
Mozilla/5.0 (X11; Linux x86_64; rv:50....
1
vote
1answer
80 views
Does setting DNT make one a target to extra tracking?
Does adding the "Do Not Track" (DNT) to HTTP headers make one a target for extra tracking, such as in-depth browser fingerprinting?
4
votes
1answer
261 views
Why does Tor Browser disable Javascript optimizations?
The security level slider in Tor Browser disables various Javascript optimizations.
How can the presence or absence of optimizations be a browser tracking method?
2
votes
1answer
289 views
Extracting as much information from a browser request as possible?
I am currently working on project that involves identifying spammers who are creating fake accounts on my site. I am interested to know what type of information I would be able to extract.
First of ...
1
vote
0answers
21 views
Why do phones only allow for 5 fingerprints? [duplicate]
Why do mobile phones only allow for 5 fingerprints for the fingerprint sensor? Is this for security reasons? I am guessing that this was this limitations was for security, opposed to a design choice. ...
2
votes
0answers
98 views
Are there successors to httprecon [closed]
httprecon appears to be dead, the latest update per changelog is from 2009. Are there any successors?
4
votes
2answers
344 views
Unique(ish) OS / hardware fingerprinting
In the manners of Browser fingerprinting, is it possible to obtain a somewhat unique fingerprint for the device OS and hardware (a 1 out 1000 entropy score would be good enough for my needs)
Edit:
...
2
votes
1answer
162 views
Adobe Flash Inside Whonix Workstation
It's known that Flash can give away your real IP address to web services if you use it in Tor Browser directly run by your computers OS. But what if you use flash inside a Whonix workstation (either ...
6
votes
1answer
952 views
What unique fingerprinting information can an iOS 10 app collect?
As a follow-on to these questions:
What unique fingerprinting information can an iOS7 app collect?
What unique device fingerprinting information can an iOS8 app collect?
What unique device ...
1
vote
1answer
423 views
How to fingerprint a server with Netcat?
I am trying to follow the OWASP test guide on a Kali Linux machine. As the first step in "Information Gathering" I am trying to fingerprint the server. The guide instructs me to use NetCat:
$ nc www....
1
vote
1answer
321 views
Passive fingerprinting of DNS client
Given a network trace that includes DNS request packets, is it possible to infer or guess which DNS client send those requests?
In other words, consider a network monitoring box that can see all the ...
0
votes
2answers
92 views
Is exposing the default plesk page dangerous?
Is exposing the default plesk page on an IP dangerous? I can imagine it is somehow usable for fingerprinting a version maybe. But is it dangerous anyhow?
2
votes
0answers
2k views
How to change system fonts list in Firefox to avoid browser fingerprinting? [closed]
I found solution for most of types of browser fingerprints:
IP - ZenMate Firefox VPN Add-on
Canvas - CanvasBlocker Add-on
Timezone - I use AutoIt to change Windows Timezone
List of PlugIns - I just ...
0
votes
1answer
39 views
Is there a way to guess a shared server's control panel's version?
I am performing research on the security of control panel software for shared hosting providers, and I am interested to know if there is a way to identify the version of the control panel software ...
7
votes
3answers
2k views
Passive fingerprinting of HTTPS client
Is it possible to passively fingerprint a HTTPS client, based solely on data visible to a network eavesdropper?
In other words, consider a network monitoring box that can see all the packets (but ...
1
vote
1answer
563 views
What is vulnerable in this comprehensive browser setup to avoid fingerprinting/tracking?
What is vulnerable in this browser setup to avoid fingerprinting/tracking for general browsing that is still easy to use?
The setup is as follows:
Firefox on my personal machine with several ...
5
votes
1answer
224 views
Can HPKP be used to track users?
There is already a large flora of "supercookies" and browser fingerprinting methods out there. I am wondering whether HPKP provides yet another method to track users?
A server could send an extra ...
3
votes
1answer
574 views
Is Google using canvas fingerprinting for their ads?
Given the fact that canvas fingerprinting is a hype, I raise my eyebrows whenever I see fillText or strokeText in JavaScript code executing on websites. I noticed that Google uses some of these eye ...
1
vote
3answers
967 views
Fingerprinting users based on IP addresses
Is your local IP address used to better "fingerprint" a specific user? As far as I understood TCP connections, your local IP is send to the remote server in IP packets. It could add to the overall ...
6
votes
1answer
2k views
Can canvas fingerprinting be prevented?
How can canvas fingerprinting be prevented in web browsers? The site Panopticlick said I had a hash of WebGL fingerprint of 5 bits of entropy. I installed CanvasBlocker addon and tested again and it ...
