bugtraq - SinFP 2.00 - a major release with many new features

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060615165541.GA12108@aphazel.enslaved.lan>
Date: Thu, 15 Jun 2006 18:55:42 +0200
From: GomoR <bt@...or.org>
To: bugtraq@...urityfocus.com
Subject: SinFP 2.00 - a major release with many new features


Download: http://sourceforge.net/projects/sinfp/
Info:     http://www.gomor.org/sinfp

Mailing list: https://lists.sourceforge.net/lists/listinfo/sinfp-discuss

NEWS FOR 2.00:

 - complete rewrite
 - sinfp.db completely reworked
 - new tests based on comparison between probe and response (TCP seq/ack
   comparison, IP ID value comparison)
 - new matching algorithm, works like a search engine (a problem of finding
   intersection, by applying a deformation mask on keywords) much more
   efficient than in 1.xx branch
 - possibility to manually pass a matching mask to change at will the
   matching algorithm
 - passive fingerprinting much more acurate thanks to new matching algorithm
 - possibility to launch P1P2P3 probes, or only P1P2 probes, or only P2 probe
 - match IPv6 signatures against IPv4 ones
 - API changes, not compatible with 1.xx version anymore
 - DB schema changes, not compatible with 1.xx version anymore
 - many bugfixes

OLD NEWS FOR 1.00:

SinFP is a new approach to OS fingerprinting, which bypasses limitations
that nmap has.

Nmap approaches to fingerprinting as shown to be efficient for years.
Nowadays, with the omni-presence of stateful filtering devices, PAT/NAT
configurations and emerging packet normalization, its approach to OS
fingerprinting is becoming to be obsolete.

SinFP uses the aforementioned limitations as a basis for tests to be
obsolutely avoided in used frames to identify accurately the remote
operating system. That is, it only requires one open TCP port, sends only
fully standard TCP packets, and limits the number of tests to 2 or 3 (with
only 1 test giving the OS reliably in most cases).

Features list:
 - full OS fingerprinting suite, built as a Perl module
 - active fingerprinting
 - passive fingerprinting (with signature matching made against active ones)
 - works the same over IPv4 and IPv6 (yes, IPv6 fingerprinting)
 - online mode
 - offline mode (especially useful when you have a pcap file)
 - heuristic matching algorithm to avoid the need to write new signature for
  a target stack which has some TCP option deactivated, or changed window
  size, for example

To know more: http://www.gomor.org/sinfp .

-- 
  ^  ___  ___             http://www.GomoR.org/          <-+
  | / __ |__/          Systems & Security Engineer         |
  | \__/ |  \     ---[ zsh$ alias psed='perl -pe ' ]---    |
  +-->  Net::Packet <=> http://search.cpan.org/~gomor/  <--+