Penetration Testing: Re: Fingerprinting Windows O/S based on ports open?

["Daniel K" <hadasg () barak net il>]

Open ports on WinXP Default install:
 TCP 135
 TCP 139
 TCP 445
 TCP 1025
 And Most important (so we know its xp):
 TCP 5000 (upnp)

----- Original Message ----- 
From: "lsi" <stuart () cyberdelix net>
To: "Robert Masse" <rmasse () gosecure ca>
Cc: <pen-test () securityfocus com>
Sent: Tuesday, October 21, 2003 11:57 AM
Subject: Re: Fingerprinting Windows O/S based on ports open?


> Open ports on a W2K default install:
>
> TCP 135
> TCP 445
> TCP 1025
>
> (1025 is something to do with the task scheduler)
>
> Open ports on a W98SE default install:
>
> TCP 139
>
> Stuart
>
> On 20 Oct 2003 at 14:59, Robert Masse wrote:
>
> Subject:        Fingerprinting Windows O/S based on ports open?
> Date sent:      Mon, 20 Oct 2003 14:59:13 -0400
> From:           "Robert Masse" <rmasse () gosecure ca>
> To:             <pen-test () securityfocus com>
>
> > Hi
> >
> > Does anyone have a matrix of TCP/UDP ports open per default install of
> > Windows (OS focused, not application focused like having tcp 80 for
> > iis)?  I cannot use classic O/S fingerprinting with NMAP nor can I use
> > passive fingerprinting like P0f....
> >
> > I need a simple table like:
> >
> > Win95               Win98               NT4                  W2K
> > ME                   XP
> >
> > TCP 133455      y                      n                      y
> > n                      n                      y
> > UDP 1234535    y                      n
> > TCP 1543637
> > TCP 4434565
> >
> > Etc
> >
> > Etc
> >
> > Of course the example I used above is bogus but I am too lazy to type in
> > all the results.  I don't have access to 95, 98, ME etc so I cannot
> > verify myself.
> >
> > Any help would be appreciated; I need a list of ports per O/S soon for a
> > personal project.
> >
> > Once I have my information, I will post the results.
> >
> > Thanks
> >
> > Rob
> --------------------------------------------------------------------------
-
> > FREE Whitepaper: Better Management for Network Security
> >
> > Looking for a better way to manage your IP security?
> > Learn how Solsoft can help you:
> > - Ensure robust IP security through policy-based management
> > - Make firewall, VPN, and NAT rules interoperable across heterogeneous
> > networks
> > - Quickly respond to network events from a central console
> >
> > Download our FREE whitepaper at:
> > http://www.securityfocus.com/sponsor/Solsoft_pen-test_031015
> --------------------------------------------------------------------------
--
> -- 
> Stuart Udall
> stuart at cyberdelix dot net - http://www.cyberdelix.net/
> ..revolution through evolution
>
> want to make some cash? check out http://cyberdelix.net/affiliates.htm
>
>
> --------------------------------------------------------------------------
-
> FREE Whitepaper: Better Management for Network Security
>
> Looking for a better way to manage your IP security?
> Learn how Solsoft can help you:
> - Ensure robust IP security through policy-based management
> - Make firewall, VPN, and NAT rules interoperable across heterogeneous
> networks
> - Quickly respond to network events from a central console
>
> Download our FREE whitepaper at:
> http://www.securityfocus.com/sponsor/Solsoft_pen-test_031015
> --------------------------------------------------------------------------
--
>

---------------------------------------------------------------------------
FREE Whitepaper: Better Management for Network Security

Looking for a better way to manage your IP security?
Learn how Solsoft can help you:
- Ensure robust IP security through policy-based management
- Make firewall, VPN, and NAT rules interoperable across heterogeneous
networks
- Quickly respond to network events from a central console

Download our FREE whitepaper at:
http://www.securityfocus.com/sponsor/Solsoft_pen-test_031015
----------------------------------------------------------------------------