On 8/21/07, Tom Griffin <t.griffin@sheffield.ac.uk> wrote:
If I suspect that a particular port on a given host is listening for
incoming Bittorrent data requests, is there a way I can prove it by
means of a probe? I have attempted to find some protocol definition
documentation so I can build a very basic script which will pretend to
be another Bittorrent client to see how the application handles it, but
I cannot find such detailed information.
If anybody can help with this, it would be much appreciated.
How sure do you have to be? Personally, if I saw a host with port
6881 listening, I would treat it as if it had BitTorrent running until
it was proven otherwise. You can try 'nmap -sV' to see if NMap can
identify the service listening, but if it is BitTorrent, NMap won't
identify it. It will fall back to a port number guess instead.
Unfortunately, connecting to a BitTorrent peer port and getting
anything useful back requires knowing the hash of a torrent being
shared on that client, which is near impossible to guess. However, if
you can sniff traffic on this port, you should be able to positively
identify it as BitTorrent because it will contain the string
'BitTorrent protocol' fairly early on in the packet data.
If you do discover a good working probe for BitTorrent, please share
it with Fyodor so that he can add it to NMap.
Good luck!
PaulM
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!
http://www.cenzic.com/downloads
------------------------------------------------------------------------
