55
votes
Accepted
Why do some web servers still provide information on vendor and version in the HTTP response headers
Yes, in theory by advertising vendor and version in the banner makes an attacker's job easier, but like only a little bit.
Even if you don't advertise it, it can be figured out from the behaviour of ...
- 59.2k
28
votes
Why do some web servers still provide information on vendor and version in the HTTP response headers
Attackers just do not care. When you have a popular website, you find bots probing for every (vulnerable) version of phpmyadmin on every conceivable path, even when your site does not use a database ...
- 3,451
14
votes
How do exploit kits enumerate or fingerprint their targets?
I think you might be assuming that the kits are more complicated than they are.
A kit is designed to exploit specific vulnerabilities. It is not necessary to 'fingerprint' and choose the best ...
- 132k
14
votes
Why do some web servers still provide information on vendor and version in the HTTP response headers
Historically, many servers returned headers like this:
Server: Apache/2.4.1 (Unix) mod_php/1.2 mod_ssl/0.9
This does give away a bit more information than you want, so most servers now default to ...
- 34.6k
10
votes
Accepted
Effect of Firefox's "Responsive Design Mode" on the browser's fingerprint
There is no single fingerprinting method. But assuming that the fingerprinting you fear tries to be as granular as possible it will not only include easily fakeable things like User-Agent header but ...
- 205k
7
votes
Accepted
How does a keypair fingerprint work?
Pubkey is INCLUDED in privkey
It's a bit confusing but the way these members of the keypair are saved is such that the pubkey is a proper subset of the information inside the privkey.
This means that ...
- 18.2k
7
votes
Accepted
Will two smartphones (identical hardware and software) generate the same canvas fingerprint?
This site describes the techniques used in canvas fingerprinting:
The technique is based on the fact that the same canvas image may be rendered differently in different computers. This happens for ...
- 59.2k
6
votes
Can canvas hash be used to track me and ruin my anonymity?
Canvas Fingerprinting
The technique you are referring to is Canvas Fingerprinting. It is one of many possible methods available for website operators to try to identify and track users without ...
- 31.5k
6
votes
Accepted
Application to detect SSL certificate fingerprint differences
There is a mechanism called Certificate Transparency. It is based on a system of public logs of issued certificates. Here you can red how it works.
MITM can have different reasons. For instance, some ...
- 12.5k
5
votes
How are Google always identifying me?
Misuse of free accounts for spamming and similar is a big problem many providers face. Thus they try to detect early if an account creation is somehow unusual, like being automated by a computer or ...
- 205k
5
votes
Accepted
methods to check https certificates
Try this
echo -n | openssl s_client -connect www.security.us.hsbc.com:443 2>/dev/null | openssl x509 -noout -fingerprint -sha256
The output should look like this:
$ echo -n | openssl s_client -...
- 2,351
5
votes
Why do some web servers still provide information on vendor and version in the HTTP response headers
As said, it's not a security issue to leave it, and it's a useful information for some client programs. Take curl for instance: it uses the Server header value to check if HTTP pipelining can be ...
- 1,371
5
votes
Accepted
What impact does an installed extension have on the browser fingerprint (uniqueness)?
There are no explicit APIs to enumerate the browser extensions. But this does not mean they are not detectable or that they cannot be included in the fingerprint even if the specific extension is not ...
- 205k
5
votes
Is there any secure way to make sure that a request comes from a browser and via a specific domain (by just using frontend)?
We could use referer or origin, but these HTTP headers can be easily overwritten or modified.
A browser can not overwrite or modify these headers. At most it can make the referer blank or reduce to ...
- 205k
4
votes
How can I detect the remote operating system?
You could use use the -T4 option together with the -A. No sudo is required (Tested on Ubuntu).
$ nmap -T4 -A 192.168.0.0/24
Would return for instance:
Nmap scan report for 192.168.0.95
Host is ...
- 159
4
votes
Unique(ish) OS / hardware fingerprinting
The Electronic Frontier Foundation (EFF)'s Cover Your Tracks (previously called Panopticlick) site is dedicated to browser fingerprinting that goes well beyond your desired 1:1000 entropy (using these ...
- 11.9k
4
votes
Accepted
Why do browsers expose installed fonts?
For ultra-precise screen layouts like games, a developer often needs to know the size something renders at. While a dev can instruct the browser to draw at say, 10px, OS font size settings, zoom, font ...
- 2,703
4
votes
Why do browsers expose installed fonts?
Browsers don't directly make a listing of the installed fonts available. Instead they provide information about the size a specific object like a textbox has. Since the same text rendered with ...
- 205k
4
votes
Accepted
Why fingerprint a browser if a fingerprint can be replayed?
Passive fingerprinting can easily be faked, and it is trivial to code responses that can pass passive fingerprinting. And yet, it can still work because not every bot includes this feature because not ...
- 132k
3
votes
Accepted
Fingerprinting servers behind firewall
When I try to pentest I like to use hping3, which you can install it very easily:
apt-get install hping3
Then for bypassing firewall:
hping3 -S 192.168.1.1 -c 80 -p ++1
If port 25, 53 or 80 is ...
- 10.2k
3
votes
Fingerprinting servers behind firewall
There are a lot of possibilities for that:
1- No ports are really open other than 80.
2- Firewall is not blocking your IP but it might be evade your results and this only with advanced firewall.
3- ...
- 323
3
votes
Why does Tor Browser disable Javascript optimizations?
The presence of certain JavaScript features can be used to fingerprint the person like
"X's unique hash is ...".
Whereas the absence of certain JavaScript features can be used to fingerprint the ...
3
votes
Antivirus and malware fingerprints
For an AV that looks for a signature, splitting your malware across files means the signature no longer exists. The AV doesn't concatenate multiple files in order to speculatively match for signatures....
- 61.5k
3
votes
How to change the browser canvas html hash for fingerprinting?
I think you've misunderstood what the canvas hash is. The "canvas" is a JS component that allows the browser to draw graphics.
The hash input is only a single thing, the binary data that makes up ...
- 1,295
3
votes
nmap script "smb-os-discovery.nse" does not output information about the host OS?
I have experienced the same "issues". If you take a look at smb-os-discovery.nse it states:
description = [[ Attempts to determine the operating system, computer
name, domain, workgroup, ...
- 1,588
3
votes
Can a fingerprint be reconstructed from a device that uses it for authentication?
Devices that support biometric authentication are equipped with Trusted Execution Environment (TEE) that stores fingerprint data in its own isolated tamper-resistant storage. The biometric sensor ...
- 6,931
3
votes
Application to detect SSL certificate fingerprint differences
The term you may be looking for is probably 'certificate pinning'.
If the application is doing the TLS connection, it should simply validate the certificate on its own. It doesn't need to check the ...
- 19k
3
votes
Possible to avoid device fingerprinting with imagemagick?
Your stated protections are reasonable, however using ML techniques (given a large enough corpus) would likely defeat them. That could be mitigated by introducing some imperceptible randomness to ...
- 1,336
3
votes
Accepted
TLS Private Key Secured with Hardware Fingerprint
There are well established solutions for the problem of protecting the private key - use a hardware security module (HSM). Here the private key never leaves the hardware because any operations are ...
- 205k
Only top scored, non community-wiki answers of a minimum length are eligible