#p0f

[heavenlywonder]

Just logged onto my ex’s email to switch over the name on the WiFi bill and hoooooly shit he’s on a lot of dating sites

[therealajsto-blog]

Finger printing SSH brute forcers

It never ends. Have a server connected to the net? You're going to get ssh brute force attacks.

Using p0f (http://lcamtuf.coredump.cx/p0f3/) we can fingerprint the attackering systems. This helps in identifying what kind of systems are infected (in the case of Windows XP, which you'll probably see a lot of) or being used.

[ph4z0n]

Published 19 December 2013 Last week, we discussed why you'd want to do passive vulnerability scanning at strategic points in your network https://isc.sans.edu/diary/Scanning+without+Scanning/17189, and which tools you might commonly do that with.  After some reader feedback, I thought we'd discuss just exactly how to do this with both p0f and PVS.  Both packages we're discussing have a gotcha or two, so it's worth a "how-to" from start to finish. And, to paraphrase the Dos Equis guy: "I don't often install an OS on bare metal, but when I do, it's usually a hypervisor".  So today's discussion will cover off two methods to do passive scanning of a network segment's traffic inside of a VM.

[savvyintel]