Nmap Development mailing list archives
Fyodor, I would like to have your point of vue on SinFP tool
From: GomoR <nmap-hackers () gomor org>
Date: Sat, 06 May 2006 17:32:49 +0200
First, if you feel this message has nothing to do here, I understand. Feel free to redirect to /dev/null. SinFP is a new approach to OS fingerprinting, which bypasses limitations that nmap has. Nmap approaches to fingerprinting as shown to be efficient for years. Nowadays, with the omni-presence of stateful filtering devices, PAT/NAT configurations and emerging packet normalization, its approach to OS fingerprinting is becoming to be obsolete. SinFP uses the aforementioned limitations as a basis for tests to be obsolutely avoided in used frames to identify accurately the remote operating system. That is, it only requires one open TCP port, sends only fully standard TCP packets, and limits the number of tests to 2 or 3 (with only 1 test giving the OS reliably in most cases). Features list: - full OS fingerprinting suite, built as a Perl module - active fingerprinting - passive fingerprinting (with signature matching made against active ones) - works the same over IPv4 and IPv6 (yes, IPv6 fingerprinting) - online mode - offline mode (especially useful when you have a pcap file) - heuristic matching algorithm to avoid the need to write new signature for a target stack which has some TCP option deactivated, or changed window size, for example To know more: http://www.gomor.org/sinfp . Or simply download and try: http://www.gomor.org/files/SinFP-1.01-3.tar.gz . -- ^ ___ ___ http://www.GomoR.org/ <-+ | / __ |__/ Systems & Security Engineer | | \__/ | \ ---[ zsh$ alias psed='perl -pe ' ]--- | +--> Net::Packet <=> http://search.cpan.org/~gomor/ <--+ _______________________________________________ Sent through the nmap-dev mailing list http://cgi.insecure.org/mailman/listinfo/nmap-dev
Current thread:
- Fyodor, I would like to have your point of vue on SinFP tool GomoR (May 06)
- Re: Fyodor, I would like to have your point of vue on SinFP tool Fyodor (May 12)
- <Possible follow-ups>
- Re: Fyodor, I would like to have your point of vue on SinFP tool GomoR (May 13)