[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-Disclosure] Re: [tool] the new p0f 2.0.1 is now out

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This sounds very simple actually, correct me if I am wrong ( I just jumped into this thread). Some IDS systems claim to do passive network monitoring and passive fingerprinting as well. They simply do checks on the packets sent from a host by sniffing the network. They do not make the request for the packet, they let other users generate packets and do the fingerprinting on those.

So, I suppose you could fingerprint a system by browsing a web page and looking at the packets being set from the web server.


Matt Barrie wrote:

Does it do DNS resolution on logfiles? If so, this may be a way of
detecting.


-----Original Message-----
From: full-disclosure-admin@xxxxxxxxxxxxxxxx
[mailto:full-disclosure-admin@xxxxxxxxxxxxxxxx] On Behalf Of Andreas
Gietl
Sent: Thursday, September 04, 2003 12:43 PM
To: thetic; Michal Zalewski; honeypots@xxxxxxxxxxxxxxxxx;
pen-test@xxxxxxxxxxxxxxxxx; focus-ids@xxxxxxxxxxxxxxxxx;
sectools@xxxxxxxxxxxxxxxxx
Cc: incidents@xxxxxxxxxxxxxxxxx; bugtraq@xxxxxxxxxxxxxxxxx;
full-disclosure@xxxxxxxxxx
Subject: Re: [Full-Disclosure] Re: [tool] the new p0f 2.0.1 is now out

On Thursday 04 September 2003 20:19, thetic wrote:

it i a passive scan-tool! you can't detect the scans because there are
no packets going to you network.



Question concerning the the POF, how can we setup a IDS to detect a


POF


scan.

umer


----- Original Message -----
From: "Michal Zalewski" <lcamtuf@xxxxxxxxxxx>
To: <honeypots@xxxxxxxxxxxxxxxxx>; <pen-test@xxxxxxxxxxxxxxxxx>;
<focus-ids@xxxxxxxxxxxxxxxxx>; <sectools@xxxxxxxxxxxxxxxxx>
Cc: <incidents@xxxxxxxxxxxxxxxxx>; <bugtraq@xxxxxxxxxxxxxxxxx>;
<full-disclosure@xxxxxxxxxx>
Sent: Wednesday, September 03, 2003 12:21 PM
Subject: [tool] the new p0f 2.0.1 is now out



I am proud to announce the new stable version of p0f, 2.0.1, a


complete


rewrite of the original open-source tool released back in 2000, and


a


major step for the utility.

I apologize for posting to all the forums, and leave it to the


moderators


to accept or drop this post - but I believe the tool is probably of


some


interest to the IDS / honeypot / pen-test / general ITSec audiences,


and


more appropriate forums are largely defunct.

------------
What is p0f?
------------

P0f v2 is a versatile passive OS fingerprinting tool. P0f can


identify


the system on machines that connect to your box, machines you


connect


to, and even machines that merely go thru or near your box. All


this


even if the device is behind a fascist packet firewall.

P0f will also detect what the remote system is hooked up to (be


it


Ethernet, DSL, OC3, or avian carriers), how far it is located,


what's


its uptime, and will often detect NAT, firewall presence, and


even


the name of the other guy's ISP - all this without sending a


single


packet.

What do you need it for?
------------------------

P0f is quite useful for gathering all kinds of profiling


information


about your users, customers or attackers (IDS, honeypot,


firewall),


tech espionage (laugh...), active or passive policy enforcement
(restricting access for certain systems or otherwise handling


them


differently), content optimization, pen-testing, thru-firewall
fingerprinting... plus all the tasks active fingerprinting is


suitable


for. And, of course, it has a high coolness factor, even if you


are


not a sysadmin.

-----------
What's new?
-----------

 Almost everything. Please upgrade and encourage your vendor to
 update his packages. P0f v2 is far superior to the old code
 and its clones (such as the Ettercap passive OS fingerprinting
 functionality, based on the p0f v1 concepts). It is faster,
 more secure, reliable, precise, accurate, feature-loaded
 (including easy service integration). It also introduces many
 new metrics, some of them "invented" for p0f v2.

NEW CORE CHECKS:

   - Option layout and count check,
   - EOL presence and trailing data [*],
   - Unrecognized options handling (TTCP, etc),
   - WSS to MSS/MTU correlation checks [*],
   - Zero timestamp check,
   - Non-zero ACK in initial SYN [*],
   - Non-zero "unused" TCP fields [*],
   - Non-zero urgent pointer in SYN [*],
   - Non-zero second timestamp [*],
   - Zero IP ID in initial packet,
   - Unusual auxilinary flags,
   - Data payload in control packets [*],
   - Non-empty IP options.

[*] Metrics "invented" for p0f, as far as I know. Other metrics
were discussed before, although usually not implemented


anywhere.


IMPROVEMENTS:

- Major performance improvements - no more runtime signature


parsing,


added BPF pre-filtering, signature hash lookups - to make p0f


suitable



for high-throughput devices,

- Modulo and wildcard operators for certain TCP/IP parameters to


make


     it easier to come up with generic last chance signatures for
     systems that tweak settings notoriously (think Windows),

- Auto-detection of DF-zeroing firewalls,

- Auto-detection of MSS-tweaking NAT and router devices,

   - Media type detection based on MSS, with a database of common
     link types,

- Origin network detection based on unusual ToS / precedence


bits,


- Ability to detect and skip ECN option when examining flags,

- Better fingerprint file structure and contents - all


fingerprints


are rigorously reviewed before being added.

- Generic last-chance signatures to cover general OS


characteristics,


- Query mode to enable easy integration with third party


software -


     p0f caches recent fingerprints and answer queries for src-dst
     combinations on a local stream socket in a easy to parse
     form,

- Usability features: greppable output option, daemon mode, host
name resolution option, promiscuous mode switch, built-in


signature


collision detector, ToS reporting, etc,

- "Officially unsupported" SYN+ACK fingerprinting mode for


silent


     identifications of systems you connect to the usual way (web
     browser, MTA),

- Fixed WSCALE handling in general, and WSS passing on


little-endian,


     many other bug-fixes and improvements of the packet parser
     (including some sanity checks).

--------------------
Download, demo, etc.
--------------------

 P0f home page is:
 http://lcamtuf.coredump.cx/p0f.shtml

 Download:
 http://lcamtuf.coredump.cx/p0f.tgz

 Contribute / see it in action:
 http://lcamtuf.coredump.cx/p0f-help/

 P0f is believed to run fine on Windows, Linux, FreeBSD, NetBSD,
 OpenBSD, MacOS X, Solaris and AIX.

Please consider contributing to the project if you liked it.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html







- -- Regards,
-simon-

       Secure Network Operations, Inc.
       http://www.secnetops.com || http://www.snosoft.com
       Office: 978-263-3829  Fax: 978-263-0033
       -------------------------------------------------------
       "Embracing the future of technology, protecting you..."

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQE/V7HNf3Elv1PhzXgRAliLAJ9IIa66dz7tKYnyRPpaotsR26pYyQCgzZ22
91DX/yMGEvaN1wByLck60Ng=
=cXXb
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html