Penetration Testing mailing list archives
Re: testing for IP address space leakage in NAT systems
From: Thomas Reinke <reinke () e-softinc com>
Date: Mon, 21 Jan 2002 16:50:53 -0500
Not reliable, but if there are any accessible web servers behind the NAT device, check the Content-Location tag. It may yield non-routable address information. Statistically, not a good bet - but still, a better than 1 in 20 chance, if the server is IIS, that you will get non-routable addressing information out of it, and that the server is giving this information to everyone who connects to it. (See http://www.securityspace.com/s_survey/data/man.200112/firewalled_cloc.html for stats breakdown) Thomas R P G wrote:
I was wondering if anyone knows of a method to test a NAT system for address space leakage. Thanks. --Bob ---------------------------------------------------------------------------- This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service. For more information on SecurityFocus' SIA service which automatically alerts you to the latest security vulnerabilities please see: https://alerts.securityfocus.com/
---------------------------------------------------------------------------- This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service. For more information on SecurityFocus' SIA service which automatically alerts you to the latest security vulnerabilities please see: https://alerts.securityfocus.com/
Current thread:
- Re: Medium Scale Scanning Best Practices, (continued)
- Re: Medium Scale Scanning Best Practices Erlend J. Leiknes (Jan 16)
- Re: Medium Scale Scanning Best Practices Gerardo Richarte (Jan 17)
- Re: Medium Scale Scanning Best Practices Renaud Deraison (Jan 17)
- Re: Medium Scale Scanning Best Practices miguel . dilaj (Jan 15)
- RE: Medium Scale Scanning Best Practices Aleksander P. Czarnowski (Jan 16)
- Re: Medium Scale Scanning Best Practices John Malconian (Jan 18)
- Re: Medium Scale Scanning Best Practices Troy Davis (Jan 19)
- testing for IP address space leakage in NAT systems R P G (Jan 21)
- Re: testing for IP address space leakage in NAT systems R. DuFresne (Jan 21)
- Re: testing for IP address space leakage in NAT systems Frank (Jan 21)
- Re: testing for IP address space leakage in NAT systems Thomas Reinke (Jan 21)
- Re: testing for IP address space leakage in NAT systems Gamble (Jan 22)
- Re: testing for IP address space leakage in NAT systems Iván Arce (Jan 22)
- Message not available
- Re: testing for IP address space leakage in NAT systems Chris Keladis (Jan 22)
- Re: Medium Scale Scanning Best Practices Erlend J. Leiknes (Jan 16)