Re: Blind Remote Buffer Overflow (fwd)

[buanzox () USA NET (Arturo Busleiman)]

Dear Matthew <mpotter () atpco com>, the email I'm forwading was sent to me
only, and it wasn't CC'ed to vuln-dev. So here it is.

---------- Forwarded message ----------
Date: Mon, 01 May 2000 00:59:15 -0400
From: "Matthew R. Potter" <mpotter () atpco com>
To: Arturo Busleiman <buanzox () usa net>
Subject: Re: Blind Remote Buffer Overflow

At 12:31 AM 5/1/00 -0300, you wrote:
> On Sun, 30 Apr 2000, Matthew R. Potter wrote:
>
> > I'm not talking with a shell ;) I'm talking about telling the diffrence
> > between say, netbsd on
> > sparx,x86, and alpha platforms. when you dont have shell. and to make it
> > harder.. lets say telnet dosent display that nice littel banner:
> > *BSD(sparc)
> > I guess I should have made my question clearer. I'm aware of how
> > fingerprinting tcp/ip/ works, etc..
> well, now I perfectly understand your question.
> I can't tell you, but I imagine that the tcp/ip fingerprint for, let's
> say, freebsd for sparc DOES SURELY have differences between it's x86
> counterpart... I imagine :)

Maybe in preformance?

For some OS'es it's just not worth it. I mean Solaris 2.X only Runs on 2
platforms, sparc and x86, excluding the 2.5.1 release which also runs on
PPC. It's just easy to assume people are running the common ones. SPARC,
x86, Alpha, those are the most common hardware platforms on the net, I
would think.