From: AdamT (adwulf@gmail.com)
Date: Fri Aug 26 2005 - 10:48:30 EDT
On 8/24/05, L3wD <l3wd@earthlink.net> wrote:
> I am looking for a method of correctly identifying Windows O/S Versions and Service Packs remotely. Here are my restrictions:
> - Performed Remotely (not in same broadcast domain)
> - No Admin Rights on Remote Box
> - No Username/Password on Remote Box
> - VERY Few Packets Generated (excluding TCP 3-way handshake)
> - Ability to **AVOID** IDS Detection
>
You should put this list to the NMAP summer of code team, they're
currently looking at reworking the whole TCP fingerprinting / OS
identification module.
I'm guessing much of what you want is going to be restricted by the
'few packets generated' condition - especially if it stops you from
establishing a connection to a remote TCP port for long enough to get
a banner message.
I suppose you'd need to plug in a sniffer and do some calibrating at
home first. Eg - get your NT4 server, and sniff traffic from it, then
apply SP1, repeat, apply SP2, etc... then look to see what's changed.
-- AdamT "Maidenhead is *not* in Kent"
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:47 EDT