Penetration Testing mailing list archives
RE: Fingerprinting Firewall
From: "David L Rice" <drice39 () cox net>
Date: Thu, 14 Apr 2005 06:23:45 -0700
Symantec Firewalls will show 2456 tcp for version 8 or SGS 5400 For older raptor firewalls look for 416 and 417 tcp -----Original Message----- From: Fatih OZAVCI [mailto:fatih.ozavci () infosecurenet com] Sent: Wednesday, April 13, 2005 12:18 AM To: Prashant Gawade Cc: pen-test () securityfocus com Subject: Re: Fingerprinting Firewall hi, some firewalls (like checkpoint fw-1) have by-default open services, you can detect firewall if this services or ports are open. for example 256/18264/264 ports are open, this firewall is checkpoint fw-1. also you can analyze tcp/ip fingerprints for firewall operation system (*bsd, linux, solaris etc.) good luck. Fatih Ozavci IT Security Consultant Prashant Gawade wrote:
hi We all know that, we can identify firewall using various methods and
tools like "firewalk".
Is there any method or tool available which will remotely fingerprint and
enumerate rule base configured on the firewall?
Prashant Vijayanand Gawade Paladion Networks Security Engineer Navi- Mumbai
Current thread:
- Fingerprinting Firewall Prashant Gawade (Apr 08)
- Re: Fingerprinting Firewall Byron L. Sonne (Apr 10)
- Re: Fingerprinting Firewall Fatih OZAVCI (Apr 13)
- RE: Fingerprinting Firewall David L Rice (Apr 14)
- <Possible follow-ups>
- RE: Fingerprinting Firewall rzaluski (Apr 11)
- RE: Fingerprinting Firewall Clement Dupuis (Apr 14)