Search Results - Antionline Forums - Maximum Security for a Connected World

Search:

Type: Posts; User: obake_hakkaa; Keyword(s):

Search: Search took 0.02 seconds.

  1. Replies
    12
    Views
    1,150

    The "CKAAAAAA" is the netbios name query...

    The "CKAAAAAA" is the netbios name query wildcard. (More proof of a samba box??)


    Take a look here: ( look at sample number 6)
    ...
  2. Replies
    12
    Views
    1,150

    str34m3r A DNS lookup isn't a netbios name...

    str34m3r


    A DNS lookup isn't a netbios name lookup and this is a netbios name query NOT a dns "name query". (which I belive is the point your trying to make??)

    If I remember correctly Windows...
  3. Replies
    25
    Views
    4,434

    I know the feeling. I too joined the site looking...

    I know the feeling. I too joined the site looking to interact with more security pros, but instead find the site filled with students ( nothing wrong with this I'm just not in the teaching mode if...
  4. Replies
    25
    Views
    4,434

    That's part of Grim (Ping Companion ) features,...

    That's part of Grim (Ping Companion ) features, so I win unless you can prove you didn't read my post or we're both wrong. :)
  5. Replies
    25
    Views
    4,434

    So, Don are you ever going to tell us what the...

    So, Don are you ever going to tell us what the packet capture was all about or is this thread just going to die on the vine like the other one?

    Security forum..hmmmmmmmm........ Guess I'll stick...
  6. Replies
    25
    Views
    4,434

    Window size can change based on network...

    Window size can change based on network congestion (sender based flow control IE: congestion window which is not advertised. Look into "slow start" or "congestion avoidance" in TCP/IP) or the buffer...
  7. Replies
    12
    Views
    1,150

    It's netbios traffic (a name query), notice...

    It's netbios traffic (a name query), notice ......

    212.x.x.x->200.x.x.x
    Time 9:10:35:689
    0000: 00 07 50 F6 0F 60 00 30 65 2E B5 C0 08 00 45 00 ..P..`.0e.....E.
    0010: 00 4E EC 68 00 00 65 11...
  8. Replies
    37
    Views
    4,829

    10dedfish TCPdump has a brother called Windump...

    10dedfish

    TCPdump has a brother called Windump which runs on Windows systems or you can simply move the dump to a *nix system. However, I didn't go back thru the tread to check how he got the...
  9. Replies
    8
    Views
    1,234

    A good analysis TS :) The 10.x.x.x subnet is...

    A good analysis TS :)


    The 10.x.x.x subnet is a private subnet and therefore should not be routable across the public domain. It will be forwarded to it's destination because the routers do not...
  10. Replies
    8
    Views
    1,234

    Do you have a packet capture of this traffic you...

    Do you have a packet capture of this traffic you could post?
    It's hard to tell what's going on based on your logs, however it's not a scan from the internet since the source IP is a reserved one....
  11. Replies
    25
    Views
    4,434

    I too find the "wintask" packets interesting....

    I too find the "wintask" packets interesting. Notice that both syn packets contain an ack which means this is a responce to something.


    It looks like the attacker is testing the FTP server...
  12. Replies
    37
    Views
    4,829

    My 2 cents ..... My first look at the packet...

    My 2 cents .....

    My first look at the packet capture doesn't support fragmentation. ( I performed a translation of the hex dump provided)


    First, there is no fragmentation offset in any of the...
  13. Replies
    11
    Views
    1,668

    Also, using Algen's methods to get access to the...

    Also, using Algen's methods to get access to the NTFS paritition, you could remove (copy to a floppy and then delete) the SAM file which will reset the admin. account password to a blank one. Note...
  14. Thread: Hello

    by obake_hakkaa
    Replies
    0
    Views
    526

    Hello

    Hey, I'm a new guy and I would just like to say "Hello". :cool:


    I look forward to learning many interesting things at this site.
  15. Replies
    10
    Views
    2,166

    I have seen routers send packets with a source ip...

    I have seen routers send packets with a source ip in the 10.x.x.x range. The IP type of 89 (it's not a port number, see post #4) and the multicast address of 224.0.0.5 point to a router using OSPF....
Results 1 to 15 of 15

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides