AW: usual iploggers miss some variable stealth scans

Subject: AW: usual iploggers miss some variable stealth scans
From: Tobi (tklein2IX.URZ.UNI-HEIDELBERG.DE)
Date: Tue Jan 18 2000 - 08:21:24 CST

• Next message: bob mare: "Warning: VCasel security hole."
• Previous message: Michael Howard: "IIS still revealing paths for web directories"
• In reply to: vecna: "usual iploggers miss some variable stealth scans"
• Next in thread: Tobi: "AW: usual iploggers miss some variable stealth scans"
• Next in thread: David LeBlanc: "Re: usual iploggers miss some variable stealth scans"
• Reply: Tobi: "AW: usual iploggers miss some variable stealth scans"
• Reply: Tobi: "AW: usual iploggers miss some variable stealth scans"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

well, I tried your nmap-patch and must say that my scanlogd detects all of
the stealth scans you mentioned in your posting.

bye
Tobi

-----Ursprüngliche Nachricht-----
Von: Bugtraq List [mailto:BUGTRAQSECURITYFOCUS.COM]Im Auftrag von vecna
Gesendet: Montag, 17. Januar 2000 20:26
An: BUGTRAQSECURITYFOCUS.COM
Betreff: usual iploggers miss some variable stealth scans

in November`99 more or less... i've discovered 5 type of new stealth scan,
with the modification of flags used normally on XMAS stealth scan.

the five type of packets that can be used for stealth scanning, and isn't
logged from the normal tcplogd/scanlogger have this flag:
URG
PUSH
URG+FIN
PUSH+FIN
URG+PUSH

this flag on packet, such FIN, XMAS (fin+urg+psh), and NULL scan (no one
flag set) cause the reply RST+ACK if port is closed, and no reply if
port is open. this is efective only against *nix system

i don't think that is an important tecnical notice... but most tcp logger
must be upgraded/reconfigurated.

i've coded patch for nmap-2.12, check http://vecna.unix.kg

Bye.
vecna

• Next message: bob mare: "Warning: VCasel security hole."
• Previous message: Michael Howard: "IIS still revealing paths for web directories"
• In reply to: vecna: "usual iploggers miss some variable stealth scans"
• Next in thread: Tobi: "AW: usual iploggers miss some variable stealth scans"
• Next in thread: David LeBlanc: "Re: usual iploggers miss some variable stealth scans"
• Reply: Tobi: "AW: usual iploggers miss some variable stealth scans"
• Reply: Tobi: "AW: usual iploggers miss some variable stealth scans"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b27 : Tue Jan 18 2000 - 14:15:15 CST