Fingerbank.org is back

The people at packetfence have brought fingerbank.org back. It has been awhile in the making, but they have 2 email lists setup now also to discuss unknown fingerprints and other topics on dhcp fingerprinting.

You can see their writeup here

Glad to see it back!

New tools to be aware of for pcap stuff

streams: http://www.honeynet.org/node/633?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+HoneynetProjectAggregated+%28Blog+postings+from+honeynet.org%29
splitting and other parsing: http://www.netresec.com/?page=SplitCap
rawcapture (winpcap not required): http://www.netresec.com/?page=RawCap

I'm sure there are a ton more buried in my email that I've missed recently, but these all looked promosing.

Directory Scanner

Not a tool I've played with, but on my list for one of these days if I ever have some time.

Supposedly can tell if it is AD, eDir, OpenLDAP, etc.

Forensics Contest #8

Well after a VERY long break they've released the latest puzzle. This one has to do more with parsing and pulling info about wireless. While I probably have the skills to do it, I'm not sure I'll participate in this one. School is finishing up and my free time is very short in this next month.

If nothing else I may just figure out the answers without writing any specific program to be released for it.

It has been out a good week so far and I have yet to grab the pcap file and look it over. Satori will probably spit out an error as I have it set to reject wireless packets as I haven't wanted to parse out the extra header info in the past.

May run into through a converter so Satori can at least read it in, though I'll lose most of what they want you to find with SSID stuff and beacon packets.

prads

After a break from programming for awhile I think I'll take a look at some C programming again. I'm not sure how much time I'll be able to put into it with work/school/life, but I'd like to take a look at C again if I can come up with an IDE I like to program in. I really dislike most of the ones I've come across in the recent past.

Anyway, the prads project seems a good place to get involved if I can dedicate some time.

The main link for them are here:
http://gamelinux.github.com/prads/

The C stuff they've done so far covers most of what they had in the perl version before. As my favorite stuff is DHCP I'm going to see if I can write a new module to dump in there. If things work out I'll give them the code, if not it will just be me getting my feet wet in C again.

If nothing else maybe we can get some of the Satori fingerprints moved into their project. If they eventually get everything done they want to they'll be doing a lot of what I originally planned on doing with Satori!

A few new updates

First, I've been working on DHCPv6 fingerprinting. Not sure how many fingerprints I'll end up with in the end, but there is a dll implemented, there is an xml file and now, thanks to Jeff, there is an update to the editor!

Fingerprint Editor 1.00.06 has been published here :
http://pagesperso-orange.fr/cycocrew/delphi/FingerprintEditorSetup.exe

He also updated the DEF File Editor to 1.00.04 :
http://pagesperso-orange.fr/cycocrew/delphi/DEFFileEditorSetup.exe

I need to get back to SIP fingerprinting one of these days also. It was added to the editor back in 1.00.05 and I have a dll and a xml file for it also, but I haven't worked much on the xml file there yet either.

Forensics Contest #6 (yeah, the last contest)

But First....

While it would have been nice to be at defcon and participate in contest #7, I didn't have that opportunity. Nor, based on some of the emails I got would have I probably done very good at it since it appeared to be wireless packets that you had to glean info from. Who knows we'll see once they post the ~50MB pcap file.

Anyway, my netbook that I won from contest #6 came in about a week ago. I just wanted to say thanks to Sherry, Eric and Jonathan for putting the contest together and to those that provided other support for it! I look forward to the next contests!

Web application Fingerprinting with Blind Elephant

I don't talk about too many active fingerprinting applications, granted I don't know that there have been a lot of new fingerprinting applications in awhile. Anyway, ran across this today from one of the many posts picked up in Google Reader. Looks promising, I'll leave it to you to find out though!

Fingerprint Editor updated

Jeff put out a new version of the XML Fingerprint Editor for me this week after I started adding SIP fingerprints to Satori. There have been a few updates recently, the main update here was for SIP, but there have been a few cosmetic changes recently also.

As for SIP and Satori, more will be coming out on that in the next few weeks. I'm short on time, but about a week ago started adding the ability for Satori to look for Server, UserAgent and a few other pieces of info out of UDP traffic. Hopefully in the next week or two I'll have something available for download!

Contest #6 winners

Erik Hjelmvik, #2 and wins some prizes finally!

Listening to the event live now.

ps, I made finalist again, just not quite in the top 3.