14

I think you might be assuming that the kits are more complicated than they are. A kit is designed to exploit specific vulnerabilities. It is not necessary to 'fingerprint' and choose the best exploit. It can just attempt to exploit what it is designed to exploit. Some kits will attempt one method after another in series until something works. For ...


13

Once it starts, a BitTorrent client generates a 20-byte identifier called peer_id, it consists of ClientIdentifierClientVersion-RandomNumbers. Granted, ClientIdentifier and ClientVersion don't provide any identification, but the RandomNumbers could be used to identify a client, and there are some things that needs to be understood: The peer_id could be ...


13

An excellent slideshow on this topic (in my opinion) is the one from Marc Rogers. Basically, he says the following: Most fingerprint systems can be hacked Fingerprint security provides convenient security, not military grade security I also like the analogy in his explanation: Door locks have been defeated with increasing elaborate picking techniques as ...


10

When you do not change anything, the Tor browser is already configured in a way that the fingerprint is identical to every other Tor browser (and is close to the most common fingerprint on the web). I recommend to rely on this instead of messing around with it by yourself since there are many possibilities to build a fingerprint. Have a look at the open and ...


9

No, I don't think photographs or HD camera footage of powerful people waving to cameras is a security flaw for several reasons: It's not trivial to get fingerprint patterns from HD cameras: it's highly unlikely that you could make a workable print from an HD camera. Even if the person in question held their finger up to the camera in perfect lighting ...


9

Are there ways to passively fingerprint (infer) the operating system or mail client that an email sender is using, based upon the headers of an email from that sender? Yes, but they are extremely prone to errors and very easy to spoof, either intentionally or unintentionally (e.g. some high-end firewall systems will "repack" a message after removing/...


9

Based on https://superuser.com/questions/363018/how-do-i-tell-what-version-and-edition-of-windows-is-on-the-filesystem you can find the Windows Version and Service pack in C:\Windows\System32\license.rtf for Windows 7. For Windows XP the information is in C:\Windows\System32\eula.txt. For Windows 10 licenses.rtf does not contain the version. Instead it ...


9

Using nmap: sudo nmap -O <target> Or if they block your ping probes you can do: sudo nmap -O <target> -Pn Sometimes you still get fake results and you should try doing an aggressive scan (can be detected and blocked by the firewall). sudo nmap -A <target>


8

It sounds like you are interested in finger printing a CMS. This can be done similar to what is done with nmap. You would need to compromise a library of unique urls, etc and than scan a page to see if they exhibit these. You can use BuiltWith.com. Here are some examples of it is use: Joomla.org being positively identified as Joomla Wordpress.org being ...


8

Firefox From Firefox 52, the battery API has been disabled and is only available to chrome/privileged code (I would assume add-ons fall into this category). For earlier versions, the battery API is enabled by default. It can be disabled by going to to about:config and setting the dom.battery.enabled to false. Changes take effect immediately on subsequent ...


7

This looks like a classical Canary Trap. Basicly I would suggest to hide encrypted information about the user in different ways: obvious QR-Code (as suggested by slugster) different colors (as suggested by Nick Wilde) page viewed as username - footer on each page replacing certain words with synonyms code information in spaces and interpunction within the ...


7

This site describes the techniques used in canvas fingerprinting: The technique is based on the fact that the same canvas image may be rendered differently in different computers. This happens for several reasons. At the image format level – web browsers uses different image processing engines, image export options, compression level, the final images may ...


6

You could compare the Last-Modified HTTP headers for some static resources (e.g images, css), from each IP, and see whether they are different. If they are different I would assume the IPs are separate hosts. You could also make a request to both IPs at the exact same moment and compare the Date HTTP header in the responses - if they are different then the ...


6

This sounds like a Zombie Cookie. There are a large number of places a web site can store state: cookies, Flash local storage, ETags, etc. When you clear your cookies, you do not necessarily clear all these places. Web sites can store an identifier in some of these other places, and track users despite them clearing their cookies. If you use a dedicated ...


6

Likely not, but you can never be sure. First, why does a website "attempted to extract HTML5 canvas image data"? The HTML5 canvas element allows manipulations of 2d images with Javascript. Among many other operations, it can draw images or videos to the canvas and then manipulate them on a pixel-by-pixel level. While there are lots of legitimate uses for ...


6

Misuse of free accounts for spamming and similar is a big problem many providers face. Thus they try to detect early if an account creation is somehow unusual, like being automated by a computer or multiple accounts created by cheap labor. By using a fresh browser profile and trying to be as undedectable as possible you are essentially behaving similar to ...


5

Configured properly, you shouldn't be able to detect snort. "Properly" means on an unconfigured/no-address-assigned port in promiscuous mode. As PTW-105 mentioned, if snort is configured to send resets then maybe you can detect it, but more likely, you'd detect that something was blocking you. The same holds true if it's in inline mode. Two things I can ...


5

Yes, it's possible, but it's a lot harder than you think, and you'll end up breaking some things no matter what. To take your full-screen video example, it's not the website that asks for the screen size, it's Javascript running on a web page, and you can't know at the time of the request if it's going to use the size to adjust a video, or to fingerprint ...


5

Given that you're attempting to defend against a Google "all-seeing-eye" attack, (and not the NSA), this is a good start. I've added a couple suggestions below. Your search engine activity will be trackable through the generation of unique links. Consider using a privacy-oriented search engine, like DuckDuckGo. You have their word they aren't trying to ...


5

Try this echo -n | openssl s_client -connect www.security.us.hsbc.com:443 2>/dev/null | openssl x509 -noout -fingerprint -sha256 The output should look like this: $ echo -n | openssl s_client -connect www.security.us.hsbc.com:443 2>/dev/null | openssl x509 -noout -fingerprint -sha256 SHA256 Fingerprint=2B:53:3C:29:EF:1E:DD:62:5A:A0:2A:D6:45:99:3C:...


4

This procedure is probably helpful in identifying and blocking a large number of bots, but people that want to steal your data, will customize and randomize as much as possible in order to avoid detection. Then No. This approach isn't the most effective against the more sophisticated scrapers. I've seen scrapers changing entirely their HTTP requests several ...


4

You asked about https, not tor which is a different question, so I'll address the https part. There's a lot of information sent in the clear to setup an https session. Probably the most obviously useful would be the client sending the cipher suites supported, cipher preferences, and SSL versions the client supports. Cipher suite support varies widely ...


4

It could, and it does, but not as much as you'd think. Your IP address can be unique or it can be different on a per-user bases. If you live alone and have your own cable model, then - for a while - you'll have a unique address. However, at some point, your lease will be up and you'll be assigned a new address and somebody else will be assigned yours. If ...


4

IP addresses were never designed as a secure means of identifying anyone, and you should be wary of trusting them to perform a security function. There are several reasons not to, but the main one is that IP addresses are not static, and are constantly changing. Network Address Translation (NAT) is used by network administrators everywhere to support ...


4

HPKP could be used for tracking in big scale since it has report URIs: Send HPKP header with includeSubdomains set and a report-uri with unique random generated parameter. Embed a hidden image from a subdomain that uses a invalid/not pinned certificate. Browser calls report-uri with unique parameter. Only issue I see is a new report-uri with new UID being ...


4

Browsers don't directly make a listing of the installed fonts available. Instead they provide information about the size a specific object like a textbox has. Since the same text rendered with different fonts causes slightly different object sizes this can be used to infer which font was used to render a specific text and thus check if a specific font was ...


4

For ultra-precise screen layouts like games, a developer often needs to know the size something renders at. While a dev can instruct the browser to draw at say, 10px, OS font size settings, zoom, font variations, and more can affect the actual rendered height. By reading back the output size, small font size adjustments can be made until it's "just right". ...


3

Reading the marketing copy from the links, the type of 'bot' you're talking about is not a typical 'browser' at all, but often just a simple script or even the venerable wget. If that is the case, then it is trivial to determine if a script is navigating or if a full-fledged browser is. But, as you suspect, if someone is interested in defeating these bot-...


3

Passive methods analysing traffic that comes into a single system are unlikely to work for you unless you have a very small network topology. Using tools like P0f or OSSIM you will learn what other subnets exist, but only if they connect to your box. You won't learn where they are in relation to each other, or even necessarily get a full picture of all the ...


Only top voted, non community-wiki answers of a minimum length are eligible