The xprobe2 application was built specifically for OS Fingerprinting or being able to accurately guess a servers Operating System. The unfortunate part about xprobe2 is that is extremely outdated and doesn’t even include Windows 7 in its list of OS’s that it can identify. Even though nmap is pretty much the staple for people to use it is still worth discussing xprobe2 because the items it can guess it does a great job at doing so. It may also be possible that you are assessing a network with some really old servers and updated apps don’t include those operating systems anymore so you may get lucky and find the old operating system using xprobe2.
I remember being so happy about 0trace when I started to write some Backtrack related articles because even though 0trace is fairly simple it is really useful to locate the full path to devices you are investigating. In the article below I will explain the necessary 0trace input from the command line, what needs to be done to complete a successful trace to a target using 0trace, and provide some example of devices in front of and behind a firewall blocking ICMP or traceroute requests.
Previously I wrote a brief article on 0trace in Backtrack 4 which can be located here however in the process of writing an updated article for Backtrack 5 I noticed that 0trace was no longer working. Every single time I would attempt to run an accurate trace through a firewall the results would come back empty and display “Probe rejected by target.” At first I was thinking maybe companies have really tightened down their firewalls however that didn’t make any sense because of how 0trace works using a standard port such as port 80 to allow traffic to pass because the servers function is to serve web pages. Below I describe the error in more detail and how you can resolve it.
Previously I wrote an article, located here, about the NK2 file on Windows that stores the email addresses you type into the “To Field” when sending emails. The NK2 file stores the history of what you type or paste into the To field so it can auto complete for you in the future. This is a great feature however deleting old entries is not always the easiest and that makes it a bit unfortunate. You can typically turn off auto complete however you could also modify the files that store the contact cache that is used for auto complete. Follow the directions below to locate email addresses stored in the To Field Outlook for Mac cache to either modify or delete.
When I got my Macbook about 9 months ago one of the first things I did was change the default OSX screenshot format type from PNG to GIF. I edit a lot of images in Photoshop to post in technical articles and for the GIF’s I have been having to change the Photoshop Image Mode from Indexed Color to RGB to apply most filters during the process of editing the image. Photoshop loses a lot of functionality when an image’s Image Mode is set to Indexed so each time I modified an screenshot image and say wanted to apply a filter I would first have to modify the Photoshop Image Mode from Indexed Color to RGB. I recently got fed up with having to do that so I was looking for a solution when I realized if I just change the default screencapture format back to PNG the images open in Photoshop with the Image Mode set to RGB or Red/Green/Blue Color Model. Anyhow when doing so I started to wonder what image formats were available to set as the default screencapture format. Below I describe the details of what screencapture image formats are available in Mac OSX Lion and also what Image Mode that Adobe Photoshop opens each format from the Mac in.