Comments on: Puzzle #4 Update http://forensicscontest.com/2010/02/17/puzzle-4-update Sat, 22 Oct 2011 00:14:20 +0000 hourly 1 http://wordpress.org/?v=3.3.2 By: Steve http://forensicscontest.com/2010/02/17/puzzle-4-update/comment-page-1#comment-550 Steve Fri, 28 May 2010 11:22:00 +0000 http://forensicscontest.com/?p=443#comment-550 @Ahmed: an exploit/a port scan could be unsuccessful from the hacker's point of view. Although, it implies an attacker and one or more targets. A target is a host that you try to attack as an attacker. In other terms, even if there is no answer from a target, it remains a target although. @Ahmed: an exploit/a port scan could be unsuccessful from the hacker’s point of view. Although, it implies an attacker and one or more targets. A target is a host that you try to attack as an attacker. In other terms, even if there is no answer from a target, it remains a target although.

]]> By: Adam http://forensicscontest.com/2010/02/17/puzzle-4-update/comment-page-1#comment-324 Adam Wed, 24 Mar 2010 19:55:24 +0000 http://forensicscontest.com/?p=443#comment-324 Nice solution, Sébastien DAMAYE! I also used a database (SQLite) to solve the puzzle, but mine doesn't have nice graphs ;) It looks like we both got the same answers so hopefully we're both correct. As far as your open question about telling the difference between SYN and TCP Connect scans when there aren't any open ports... AFAIK you're only option is to find the scanner used and differences between the two scan types. For example, Nmap apparently doesn't change the source port on SYN segments sent during a SYN scan, but it does change the source port for each TCP Connect SYN segment it sends. Nice solution, Sébastien DAMAYE! I also used a database (SQLite) to solve the puzzle, but mine doesn’t have nice graphs ;) It looks like we both got the same answers so hopefully we’re both correct.

As far as your open question about telling the difference between SYN and TCP Connect scans when there aren’t any open ports… AFAIK you’re only option is to find the scanner used and differences between the two scan types. For example, Nmap apparently doesn’t change the source port on SYN segments sent during a SYN scan, but it does change the source port for each TCP Connect SYN segment it sends.

]]> By: Sébastien DAMAYE http://forensicscontest.com/2010/02/17/puzzle-4-update/comment-page-1#comment-314 Sébastien DAMAYE Fri, 19 Mar 2010 04:16:53 +0000 http://forensicscontest.com/?p=443#comment-314 @Ahmed: an exploit/a port scan could be unsuccessful from the hacker's point of view. Although, it implies an attacker and one or more targets. A target is a host that you try to attack as an attacker. In other terms, even if there is no answer from a target, it remains a target although. @Ahmed: an exploit/a port scan could be unsuccessful from the hacker’s point of view. Although, it implies an attacker and one or more targets. A target is a host that you try to attack as an attacker. In other terms, even if there is no answer from a target, it remains a target although.

]]> By: Ahmed Adel http://forensicscontest.com/2010/02/17/puzzle-4-update/comment-page-1#comment-311 Ahmed Adel Thu, 18 Mar 2010 18:08:26 +0000 http://forensicscontest.com/?p=443#comment-311 I wanted to make sure that I understand the question about the targets right, does this question means all the IPs that responded even if they had no open ports on them?? I wanted to make sure that I understand the question about the targets right, does this question means all the IPs that responded even if they had no open ports on them??

]]> By: Deepak Khemani http://forensicscontest.com/2010/02/17/puzzle-4-update/comment-page-1#comment-229 Deepak Khemani Mon, 22 Feb 2010 06:22:12 +0000 http://forensicscontest.com/?p=443#comment-229 Hi I have submitted my ansewres for puzzle 4. Before resubmitting I would like to clarify the meaning of "First Port Scan". And regarding the sweet part of competion. If I win the competition will the prize be delivered to India as I am participating from India. Thanks Hi

I have submitted my ansewres for puzzle 4. Before resubmitting I would like to clarify the meaning of “First Port Scan”.

And regarding the sweet part of competion. If I win the competition will the prize be delivered to India as I am participating from India.

Thanks

]]> By: sherri http://forensicscontest.com/2010/02/17/puzzle-4-update/comment-page-1#comment-227 sherri Sun, 21 Feb 2010 09:31:03 +0000 http://forensicscontest.com/?p=443#comment-227 Hi Sébastien, Normally we use "tcpdump -s 0 -nn" to get our captures. The "-s 0" flag tells tcpdump to capture the entire packet, and the "-nn" tells it not to resolve hostnames or portnames. Hope that helps! If you have questions about specific discrepancies, feel free to post them and we'll be happy to give you feedback. best, Sherri Hi Sébastien,

Normally we use “tcpdump -s 0 -nn” to get our captures. The “-s 0″ flag tells tcpdump to capture the entire packet, and the “-nn” tells it not to resolve hostnames or portnames. Hope that helps! If you have questions about specific discrepancies, feel free to post them and we’ll be happy to give you feedback.

best,
Sherri

]]> By: Sébastien DAMAYE http://forensicscontest.com/2010/02/17/puzzle-4-update/comment-page-1#comment-225 Sébastien DAMAYE Sat, 20 Feb 2010 09:35:38 +0000 http://forensicscontest.com/?p=443#comment-225 Just for information, would it be possible to know the tool (and parameters) you use for your captures? It would help me understanding why my tcpdump gives me different results. Many thanks in advance. Just for information, would it be possible to know the tool (and parameters) you use for your captures? It would help me understanding why my tcpdump gives me different results. Many thanks in advance.

]]> By: Sébastien DAMAYE http://forensicscontest.com/2010/02/17/puzzle-4-update/comment-page-1#comment-221 Sébastien DAMAYE Wed, 17 Feb 2010 17:18:04 +0000 http://forensicscontest.com/?p=443#comment-221 Maybe you should precise what you hear by "FIRST port scan". Do you want us to precise THE scan type Mr. X uses for the VERY FIRST port he scans (may only include ONE port) OR the ports scans techniques used for the FIRST campaign of port scan (may include many techniques and many ports)? Thank you for your precisions. Maybe you should precise what you hear by “FIRST port scan”. Do you want us to precise THE scan type Mr. X uses for the VERY FIRST port he scans (may only include ONE port) OR the ports scans techniques used for the FIRST campaign of port scan (may include many techniques and many ports)? Thank you for your precisions.

]]>