Security Cloak : How To Fool Passive Os Scanner

[pavs]

Security Cloak is designed to protect against TCP/IP stack fingerprinting and computer identification/information leakage via timestamp and window options by modifying relevant registry keys. The settings used are based on the results of SYN packet analysis by p0f. While the OS reported by other OS detection scanners were not identical to those of p0f, testing against Nmap, xprobe2, queso and cheops showed that they were unable to identify the correct operating system/version after Security Cloak settings had been applied.

" http://www.linuxhaxor.net/2007/07/23...ve-os-scanner/ "

pavs

[metguru]

Is this odd or is this just me? joining multiple forums and within days posting the same thing?
http://www.rohitab.com/discuss/index...howtopic=26051

[nihil]

It is you metguru,

pavs has posted 3 times in 5 years?

I have downloaded the stuff and will try it out.............

It is a mirrored labrat, so I really don't care

[Nokia]

TBH I don't think OS fingerprinting is accurate enough to warrant deploying something to defend against it. From experience I have found Xprobe to be the most reliable and Nmap to be one of the most unreliable (I still have an unpatched XP box that Nmap insists is 2000 sp 3), but even xprobe is only reliable 60 - 70 % of the time and unless you have used it regularly it can be hard to know which xprobe result to chose as it is not always the first choice.

If a target is running a web server then you are likely to be around 90% accurate using httprint or similar but other than that it is a guessing game with an element of look involved.

They can all obviously tell a Windows box from a Linux box, but when it comes to the different flavours of the OS they are mostly found wanting.

[pavs]

Metguru--> yes it is kinda odd I guess. I am been a member of antinonline for years and been following this forum for just as long. But only now I am posting something, because I am trying to promote my site, if you don't like it I can understand that, but I don't think there is anything wrong with promoting your site as long as it has good content in it.

Nokia--> there is two kinds of finger printing (apart from being active and passive); there is fingerprinting that us mortals do and there is fingerprinting that site's like netcraft does.
Good luck with fingerprinting google.com with their exact version of server/OS, and with 90% of the time with extreme accuracy.

" http://toolbar.netcraft.com/site_rep...www.google.com "

It's only hack like this (actually you need more than security cloak to achieve what ebuyer.com has achieved, which needs a discussion of it's own) that makes it possible to fool scanner like netcraft:
ie,
" http://toolbar.netcraft.com/site_rep...www.ebuyer.com "

Cheers,
pavs

[metguru]

Metguru--> yes it is kinda odd I guess. I am been a member of antinonline for years and been following this forum for just as long. But only now I am posting something, because I am trying to promote my site, if you don't like it I can understand that, but I don't think there is anything wrong with promoting your site as long as it has good content in it.

Hey, its all good, im not tryin to start anything, I just noticed it and thought it would be good to bring up.

[pavs]

My article got mentioned in the first page of hackszine.

http://hackszine.com/

Cheers,
pavs

[mungyun]

Heh, it would be kinda neat if you could dynamically cloak your fingerprint to match the persons that is looking....That would make em think a little bit.

[nihil]

Huh?

My article got mentioned in the first page of hackszine.

Hey kid, I posted it to every page of my roll of toilet tissue..............

"hackszine"............. ah!.......... way too intellectual for people here

[pavs]

Huh?



Hey kid, I posted it to every page of my roll of toilet tissue..............

"hackszine"............. ah!.......... way too intellectual for people here

Hey whatever makes you happy.

Anyways, for anyone interested:
http://www.windowhaxor.net/index.php...nd-error-page/

Using apache modsecurity module to change apache signature and error page customizing stuff.


Cheers,
pavs