Hello,
BSK wrote:
Hello,
I am doing a Penetration Testing for 2 IP addresses.
My findings till now for both the servers are exactly
same. I strongly feel that both the IPs belong to the
same machine. May be a scenario where two NICs are on
the same machine with two Public IPs. I ran HPING to
match their IP IDs but it shows different series for
both of them.
Is there any other technique that we can use to
ascertain such a situation?
Steven Bellovin did a paper on counting unique hosts behind NATs a while
back, using some techniques that might be implementable manually with
hping and so on... *googles* ah, here we are:
http://www.cs.columbia.edu/~smb/papers/fnat.pdf
"A Technique for Counting NATted Hosts
Steven M. Bellovin
smb@research.att.com
AT&T Labs Research
"Abstract— There have been many attempts to measure
how many hosts are on the Internet. Many of those endpoints,
however, are NAT boxes (Network Address Translators),
and actually represent several different computers.
We describe a technique for detecting NATs and counting
the number of active hosts behind them. The technique is
based on the observation that on many operating systems,
the IP header’s ID field is a simple counter. By suitable
processing of trace data, packets emanating from individual
machines can be isolated, and the number of machines
determined. Our implementation, tested on aggregated local
trace data, demonstrates the feasibility (and limitations)
of the scheme."
I remember it well, because the massively detailed graph data choked my
printer :)
ISTR some related research appeared in the last year or two that went
further than this, but my memory's frustratingly hazy and google's not
working for me at this late hour.
This:
http://www.mit.edu/~rbeverly/papers/tcpclass-pam04.pdf
is along similar lines,.. but that's not what I'm trying to remember.
Something to do with Dan Kaminsky? Or p0f? anyone?
cheers
\a
--
Andrew Simmons
MessageLabs Security Dept.
______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email
______________________________________________________________________
------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:
Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:
http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------
