full-disclosure - Re: Exploring the UNKNOWN: Scanning the Internet via SNMP!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <47CEC5DF.2030000@s0ftpj.org>
Date: Wed, 05 Mar 2008 17:10:07 +0100
From: "KJK::Hyperion" <hackbunny@...tpj.org>
To: sub <sub@...m641a.net>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Exploring the UNKNOWN: Scanning the Internet
 via SNMP!

sub ha scritto:
> "Previous scanning worms, such as Code Red, spread via many threads,
> each invoking connect() to probe random addresses.

what the hell is this? visiting the iniquity of the applications upon 
the protocols? Winsock is probably the only API that lets you connect() 
asynchronously (via the "non-standard" ConnectEx extension, but still). 
And if you have access to raw sockets, the whole point is moot because 
(IIRC) the advantages of SYN cookies work both ways

(Oops, sorry for the copy to your inbox, sub. Blame the mailing list 
administrators, Thunderbird's clunky UI and my lazyness)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/