Re: Uniquely identifying an Nmap install from NSE?

[Ron <ron () skullsecurity net>]

On 08/07/2009 05:19 PM, Brandon Enright wrote:
> What about stealing one from the conficker playbook and use the current
> week as a source of entropy.
>
> Something like svcname = hash(localip + localmac + remoteip + week)
>
> Still not much entropy but certainly raising the bar above just MAC.
>
> Brandon

I don't think including the week or remoteip would make a considerable 
difference, since they're going to be known to the attacker. But hashing 
the localip and localmac together is a good idea, it'd create a 
significantly more difficult bruteforce.

Ron

--
Ron Bowes
http://www.skullsecurity.org/

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org