mailing list archives
Re: Nmap Fingerprint Submitter - Broken?
From: David Fifield <david () bamsoftware com>
Date: Sat, 15 Dec 2007 12:00:11 -0700
On Sat, Dec 15, 2007 at 06:39:57PM -0000, Rob Nicholls wrote:
I just tried out the Nmap Fingerprint Submitter, but it keeps telling me
"Fingerprint doesn't look good! Please check that it pasted OK."
I did a quick test and 4.21ALPHA4 (from a different box, but against a
similar system) gives me a fingerprint that looks like:
Which it accepts, but later versions say:
4.23RC3 (SVN 6369):
The fingerprints really are bad, in that there was something weird in
the scan that makes them unsuitable for the database. That's what the
"G=N" (good=no) part of the SCAN line means. See
("Decoding the SCAN line of a subject fingerprint").
If you look through the output you will find lines that look like
OS fingerprint not ideal because:
No exact OS matches for host (test conditions non-ideal).
From the fingerprints it looks like the problem is that you didn't
receive a port unreachable message from the UDP probe.
That's why it didn't package the fingerprint for submission (wrap lines
and prefix with "OS:"). It only printed the fingerprint at all because
you must have been in debugging mode. Basically you should only submit a
fingerprint when Nmap asks you to ("If you know what OS is running on
it, see http://insecure.org/nmap/submit/").
start of every line, which appears to have changed in recent versions of
nmap. We also appear to space out the TX lines (although I don't know if
that's a problem or not?), putting OS: before all of these lines seems to
keep the online submitter happy. It seems to think that the following looks
valid ("Fingerprint looks good!") although I haven't tried submitting it:
You're right though, that message ("Fingerprint doesn't look good!
Please check that it pasted OK.") is confusing. It ought to say that the
fingerprint is unsuitable no matter how well you paste it.
Sent through the nmap-dev mailing list
Archived at http://SecLists.Org
RE: Vista Pro reported as Vista Home Rob Nicholls (Dec 15)