Re: Unknown App

[Fabián Gabriel Chiera <fabianchiera () hotmail com>]

Did you try with amap to identify protocols and applications?

www.thc.org

Good luck!




Fabian G. Chiera
Information Security Specialist

*****************************************************************
This message and any attachments are intended for the use of the 
addressee(s) only and may be confidential and covered by the attorney/client 
and other privileges. If the reader is not the intended recipient, DO NOT 
READ, notify
sender and delete this message. In addition, be aware that any disclosure, 
copying, distribution or use of the contents of this message is strictly 
prohibited.
*****************************************************************




> From: ilaiy <ilaiy.e () gmail com>
> Reply-To: ilaiy <ilaiy.e () gmail com>
> To: "Bartholomew, Brian J" <BartholomewBJ () state gov>
> CC: thenightweighsheavy () gmail com, pen-test () securityfocus com
> Subject: Re: Unknown App
> Date: Thu, 21 Jul 2005 15:49:33 -0500
> MIME-Version: 1.0
> Received: from outgoing.securityfocus.com ([205.206.231.26]) by 
> mc10-f28.hotmail.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 21 Jul 2005 
> 19:36:24 -0700
> Received: from outgoing.securityfocus.com by outgoing.securityfocus.com     
>      via smtpd (for mail.hotmail.com [65.54.166.230]) with ESMTP; Thu, 21 
> Jul 2005 19:36:24 -0700
> Received: from lists.securityfocus.com (lists.securityfocus.com 
> [205.206.231.19])by outgoing2.securityfocus.com (Postfix) with QMQPid 
> 4863514457F; Thu, 21 Jul 2005 20:08:46 -0600 (MDT)
> Received: (qmail 24792 invoked from network); 21 Jul 2005 14:10:39 -0000
> X-Message-Info: JGTYoYF78jGHVCE06r7n1cMtPB8EPb+9SWA4lQUr6PE=
> Mailing-List: contact pen-test-help () securityfocus com; run by ezmlm
> Precedence: bulk
> List-Id: <pen-test.list-id.securityfocus.com>
> List-Post: <mailto:pen-test () securityfocus com>
> List-Help: <mailto:pen-test-help () securityfocus com>
> List-Unsubscribe: <mailto:pen-test-unsubscribe () securityfocus com>
> List-Subscribe: <mailto:pen-test-subscribe () securityfocus com>
> Delivered-To: mailing list pen-test () securityfocus com
> Delivered-To: moderator for pen-test () securityfocus com
> DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;        s=beta; 
> d=gmail.com;        
> h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; 
>        
> b=JlXDgQlyzJE1v3MrKkx/j7WvahFF2SUekj2a40QJ3XHEPkIyUg6zhQRB4Bi/wKFI2FRJrC4XYb5b/zCiyjMBZCpAKtPeyMUC1fJpLZHDEurYpyu/MqdK27eVV0NSpq+wadgDmltOiVCo47EBk0GPCYExXhM0MqLTK1/qidoj+Is=
> References: 
> <9ABD10282E7D5F42AE291F5843857F6A014B3AEC () sa20dsacdmb01 ds state sbu>
> Return-Path: 
> pen-test-return-1078477244-fabianchiera=hotmail.com () securityfocus com
> X-OriginalArrivalTime: 22 Jul 2005 02:36:24.0887 (UTC) 
> FILETIME=[27681C70:01C58E66]
>
> You could use TCPVIEW to get what application and the remote IP
>
> http://www.sysinternals.com/Utilities/TcpView.html
>
> ./thanks
> ilaiy

_________________________________________________________________
MSN Amor: busca tu ½ naranja http://latam.msn.com/amor/