In passive OS fingerprinting, an attacker installs a sniffer on any third party such as a router on which the victim communicates frequently. Now he studies the sniffer’s log and responses, and receives hints about the remote OS with the help of the following parameters:

* TTL values: This is Time To Live Value for any packet sent by any host.
* The window size: For many operating systems, the initial window size value is fixed.
* Don’t Fragment bit (DF): Some operating systems keep the DF bit on, and some do not.
* Type of service: The type of service value varies from OS to OS.

When an attacker identifies these values from sniffer’s logs, he matches them with his database of known signatures of operating systems and receives a clue about which OS is running on the remote computer.

Explore More

Critical SQL Injection in Red Link

PlanetCreator has reported another critical SQL Injection (vulnerability) on Red Link http://www.redlink.net.mm/ SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of

Read More

Malaysia mymasjid.net.my’s Web Vulnerability, MySQL Injection

PlanetCreator has reported another critical MySQL Injection (vulnerability) on www.mymasjid.net.my This vulnerability has been alerted to :- Webmaster : [email protected] Applications: ———— PlanetCreator’s_Universal_Advanced_Internet_Securi ty_T00L System Time: ———— (UTC+08:00) Kuala Lumpur,

Read More

What are snort rules?

Snort rules are the conditions specified by a Network Administrator that differentiate between normal Internet activities and malicious activities. Snort rules are made up of two basic parts: * Rule

Read More