Questions tagged [fingerprinting]

Gaining information about current version of an application or operating system in order to find a vulnerability.

Filter by
Sorted by
Tagged with
1
vote
1answer
57 views

Which approach is technically more effective to hinder user tracking - fingerprint generalization or randomization?

Tor's approach to countering fingerprinting is to make as many users "appear the same" as possible. Let us call this "generalization". While Brave tries to randomize all fingerprints of each and every ...
1
vote
0answers
53 views

Evade VPN fingerprinting

Some services, like https://2ip.io/privacy/, are able to detect (correctly) OpenVPN and its settings. For example, in my case: OpenVPN, AES, MAC is SHA512. How VPN fingerprinting works? I thought the ...
0
votes
0answers
53 views

nmap script “smb-os-discovery.nse” does not output information about the host OS?

I was following this Lynda course. https://www.linkedin.com/learning/ethical-hacking-enumeration/enumerating-smb-from-linux-episode-1 The instructor used this script to detect the OS of the target ...
0
votes
0answers
43 views

What are the various defense mechanisms against audio fingerprinting

L. Cuccovillo in his paper Audio tampering detection via microphone classification talks about identification of the uniqueness in the output generated by the microphones which can act as a ...
0
votes
2answers
87 views

Can I bypass basic auth to fingerprint a web server with Httprint or netcat? [closed]

There is a web server I'd like to recon using httprint. But that web server has a basic auth protection on 443. Port 80 is not responding. When I launch httprint, it says Unspecified Error The same ...
0
votes
1answer
127 views

How to configure a VM to protect all my hardware fingerprint from guest OS and softwares?

This question was originally Does Firefox in VM have a common enough fingerprint so I don't need tor browser? in Tor community. I want to know about what a web browser's fingerprint like in a VM, ...
3
votes
0answers
64 views

How can we protect encrypted files and directories from being fingerprinted when stored on online storage services?

Assuming that online storage providers are considered untrusted, if files and directories are encrypted, how can these be protected against fingerprinting? The files are encrypted using rclone's ...
1
vote
1answer
95 views

Why fingerprint a browser if a fingerprint can be replayed?

I'm facing an issue with rampant scraping and abuse on a website that costs me a good chunk of money to maintain. So, I have been looking to implement a few solutions, and apparently these solutions ...
0
votes
1answer
62 views

Possible to detect tools like HTran from network analysis?

There is a publicly available tool called HTran which is widely used by criminal groups in cyberattacks to exfiltrate data. It simply relays traffic from one host to another, much like a proxy. It is ...
0
votes
3answers
240 views

How is browsing from a virtual machine/virtual box preventing fingerprinting or tracking?

Does it increase your internet security in terms of privacy/tracking/fingerprinting if you are surfing with your web browser in a virtual machine environment (virtual box + VPN) instead of surfing ...
1
vote
1answer
101 views

Fingerprint FTP services without Banner message

I want to write a python script that is able to fingerprint ports on a server to identify the FTP client running on the port. While there is often a Banner message upon connection, this message is ...
1
vote
0answers
70 views

How do fingerprinting techniques involving Canvas and WebGL work?

Websites can fingerprint a web browser with techniques involving WebGL and HTML5 Canvas. The website like https://amiunique.org/fp shows an example of this. How exactly do these techniques work? I ...
2
votes
0answers
54 views

Does photo fingerprinting (using metadata) allow to search all photos on internet made by the same user (privacy issue)?

Browser fingerprinting is well-known: since a client gives many HTTP attributes/Javascript attributes during a website visit, the probability that two users have the same exact values for all this ...
2
votes
1answer
590 views

How to change the browser canvas html hash for fingerprinting?

building on this previous post Can canvas hash be used to track me and ruin my anonymity? I want to ask: Is there any way a user can affect this canvas html hash generation, a way to make the hash ...
4
votes
1answer
524 views

Can canvas hash be used to track me and ruin my anonymity?

I have heard there is a fingerprinting method that traces internet users based on browser data. I believe it is called "canvas HTML hash". This hash is unique, as I understand? Or does it change ...
38
votes
5answers
7k views

Why do some web servers still provide information on vendor and version in the HTTP response headers

I think in the security field it is a well-known fact that its not a good idea to let the web server vendor (e.g. Apache) and the version be visible to the outside as this can be used to launch ...
0
votes
0answers
316 views

How to fingerprint Windows 10 reliably?

Recently, I have been practicing penetration testing and I have come to a standstill when trying to fingerprint the OS for a Windows 10 target with nmap. For the most part, I'm not able to identify ...
-2
votes
2answers
310 views

Antivirus and malware fingerprints

I´m a student in IT security and I would like to know how the malware fingerprints work in common AntiVirus. I understand that when a malware is detected it's because the binary fingerprint is known ...
1
vote
3answers
155 views

Do I have to do any setup if I want to run a VPN with the Tor browser bundle?

I know there will be some votes against this but I want to run a VPN alongside the Tor browser. Can I just open the VPN program, connect to the VPN provider, then open the Tor browser and use it as ...
0
votes
1answer
60 views

Fingerprinting Windows Architecture from a file on remote system

This is a post following up with this one. Similar situation as the above post - I'd like to know if there's a way to find out the architecture (x86 or x64) of a windows system from a file on a ...
1
vote
0answers
65 views

Is perceptual hashing feasible to identify users [closed]

I have been shadow-banned on an app (Tinder) and I cannot get around it. I have been doing some background research into how they are able to identify me and have come across device fingerprinting (I ...
8
votes
1answer
450 views

Will two smartphones (identical hardware and software) generate the same canvas fingerprint?

When using Canvas Fingerprint (like on this website) to distinguish users, does two smartphones (same model, same OS version, and no browser/plugin customization) will share the same fingerprint?
2
votes
0answers
255 views

How to defend against adblock detection/adblock subscription leaks?

Is there a best practice (or useful extension) for defending against adblock fingerprinting techniques? I'm not asking about how to bypass adblock detection as such, but rather how one might appear ...
0
votes
1answer
205 views

How os fingerprinting works and how to prevent it in browser? [duplicate]

For privacy I always changed my useragent of browser regularly and it used to work. But lately changing useragent alone in browser dosen't prevent os fingerprinting. Tools like https://browserleaks....
2
votes
1answer
697 views

How to mitigate the consequences of being tracked by fingerprint2.js?

A webpage of a bank, where I get redirected to make a payment for my ticket, uses fingerprint2.js. The webpage doesn't work at all when I'm using AdBlock extension in my browser and fingerprint2.js ...
2
votes
2answers
437 views

How does Cloudflare track their client? Tor is not a workaround

I mirrored a ecommerce site using wget. This site seems to use Cloudflare to handle their web traffic. What's interesting is that after 90 % or so of the mirroring was done, wget started to produce/...
3
votes
1answer
139 views

Is there a way to find out what information website queries about us? [closed]

What tool or software should I look for to find out what "fingerprinting" data a website is tracking? Like, I want to know, if website looks for a cache and/or fonts installed in system, or Canval, ...
3
votes
1answer
499 views

Will disabling WebGL make me more or less unique on the internet?

I have wondered whether disabling WebGL will make me more or less unique, I fiddled around with https://panopticlick.eff.org/ to see what would happen. If I keep it enabled I am 1/205.66, with me ...
0
votes
1answer
105 views

What is ScriptSafe's “Client Rectangles” and what information does it leak?

Just wondering how this one affects the privacy and security because it breaks a lot of sites displaying images for example.
-1
votes
2answers
1k views

Does multi-factor authentication make tracking/fingerprinting easier?

Is multi-factor authentication a privacy risk? Does it make tracking/fingerprinting easier? It was seem so because whoever is accepting the OTP could track and record every OTP request and metadata ...
5
votes
2answers
537 views

What “timing attacks” could websites perform using last modified dates of files?

https://developer.mozilla.org/en-US/docs/Web/API/File/lastModified describes the .lastModified property of a File object in JavaScript (usually created when a user selects a file via a HTML <input ...
1
vote
0answers
125 views

How can I fingerprint Yii framework version?

I am currently testing in a black box manner an application written in Yii framework. How can I fingerprint Yii framework exact version? It's there a public file or function that I can use to perform ...
2
votes
1answer
179 views

How can Telegram find my phone number on iOS 11 after uninstall?

I wanted to sign in Telegram on my iPod Touch running iOS 11 with another account. I deleted the app and install it again. On the sign up screen Telegram filled the phone number field with the number ...
2
votes
1answer
438 views

How reliable is using Fingerprint sensor (iPhone/Android) for identity approval?

What I'm trying to achieve is a confirmation of transaction (not payment) with a fingerprint sensor. Pretty much like Google does in its Play store: Chose a product, click pay Approve your choice ...
0
votes
1answer
144 views

Re-run nmap OS fingerprint match with existing subject fingerprint

I have a collection of nmap subject fingerprints (described here), but have updated my local (private) reference fingerprint database since they were collected. Is there any existing way to re-match ...
1
vote
0answers
192 views

Digital Camera Fingerprinting via Instagram and Snapchat

I was going through one of the articles on camera fingerprinting that says that using most basic Instagram or Snapchat filters will not get rid of the camera fingerprint. However, changing the ...
2
votes
1answer
325 views

How does a keypair fingerprint work?

Setting up an AWS instance with the instructions here, I create a public/private keypair. I understand the public key fingerprint is usually just a hash of the public key. However, the instructions ...
10
votes
2answers
894 views

How do exploit kits enumerate or fingerprint their targets?

My current understanding is that an exploit kit will fingerprint (gather information on) a system, check those details against a database of vulnerabilities and then attempt to use the relevant ...
2
votes
1answer
813 views

methods to check https certificates

I have a basic question regarding fingerprints of https certificates, the specific case I wanted to check being my online banking service. With firefox on linux, I can visit the specific web page and ...
1
vote
0answers
92 views

Can websites collect browser data without using http requests? [closed]

Is it possible for a website to collect data such as the plugins/fonts installed without sending it thought http requests? If so, is there any plugin for any browser that tells the user what type of ...
1
vote
0answers
52 views

Flow watermarking / fingerprinting

It is known that flows can quite easily be fingerprinted and watermarked [1] (usually observing or adding jitter to packets). Let's say someone added a watermark to my flow which then passes through a ...
0
votes
1answer
355 views

WAFDetect Extension of Burpsuite

I am creating a list of tools for waf fingerprinting. I have installed waf-detect plugin from bapp store in burpsuite. This plugin runs in the background and create passive scanner issues when WAF ...
0
votes
1answer
48 views

Process of finding device hostnames on LAN

Is there a reliable way to retrieve hostnames from LAN devices without having to install extra software or performing nmap-style OS fingerprinting? I'm ideally looking for either a protocol that has ...
6
votes
2answers
815 views

Why do browsers expose installed fonts?

It's a well known fact (in the privacy-aware community, at least), that a factor quite used for tracking is the list of installed fonts, which browsers seem to expose, and trackers exploit this. ...
1
vote
1answer
255 views

How are Google always identifying me? [closed]

I'm trying to create multiple Google accounts Here's my setup: I use Firefox with the FoxyProxy plugin and a bunch of IP's. I use the Firefox Random Agent Spoofer plugin, with the following ...
1
vote
1answer
128 views

Correlation between server request and response time and built-in php functions

Is there any way to identify which built-in PHP function is used in some given script only by sending a request and receiving a response from the remote server? To keep it simple we might assume that ...
12
votes
1answer
1k views

Guessing PHP version and info from phpinfo using black box analysis

Intro I'm currently experimenting with PHP black box analysis and couldn't find any useful information. There are some approaches how to determine e.g. Apache version, but for PHP it seems that ...
1
vote
2answers
255 views

WAF - How to tell what automated tool is causing alerts

When a WAF is throwing alerts your way is there a tool or way to fingerprint the the script or automated tool the potential attacker is using against the site? What techniques can I use to narrow ...
1
vote
0answers
155 views

spoof OS name in ubuntu for nmap scans [duplicate]

How can I spoof the OS CPE that is reported by nmap? This is my CPE: OS CPE: cpe:/o:linux:linux_kernel:3 when scanning with nmap leakage all my OS properties. But I need to change the original ...
1
vote
1answer
119 views

How can one avoid having their online presence traced back to an identifiable network?

I've been reading up on browser fingerprinting and device identification. Today I'd like to focus on the network side of things. Assuming I was interacting with a website on multiple occasions, but ...