mIRC Home    About    Download    Register    News    Help

Print Thread
#105585 18/12/04 03:10 AM
Joined: Dec 2002
Posts: 94
K
krunch Offline OP
Babel fish
OP Offline
Babel fish
K
Joined: Dec 2002
Posts: 94
I've written a sock port prober, but i wish to get the raw header info from the connection so it will know what it is
what would be the sockwrite command


Lets get dirty
#105586 18/12/04 05:38 AM
Joined: Dec 2004
Posts: 23
E
Ameglian cow
Offline
Ameglian cow
E
Joined: Dec 2004
Posts: 23
use sockread %var and then you can see what's being sent to you through the variable

#105587 18/12/04 06:26 AM
Joined: Dec 2002
Posts: 94
K
krunch Offline OP
Babel fish
OP Offline
Babel fish
K
Joined: Dec 2002
Posts: 94
ive got a sockread %var
but on the sockopen i'll need a sockwrite
i need to know all the cmds in there
like the GET POST etc
the one that gives header info
as in the fact is it http, ftp, etc so i can see if its a proxy or not
coz if i just go on the fact that its an open port then if that user is running a home httpd etc it will ban that ip
and i dont want that


Lets get dirty
#105588 18/12/04 06:58 AM
Joined: Dec 2004
Posts: 23
E
Ameglian cow
Offline
Ameglian cow
E
Joined: Dec 2004
Posts: 23
the poorts ur scanning depends what the user is running... for proxies/wingates its ports 23/1080 http is 80... so on and so forth.... get a list of what ports are assigned to what here:
http://www.iana.org/assignments/port-numbers
its real lengthy but it has the info I believe you're looking for
another one that might be a bit simpler is
http://www.iss.net/security_center/advice/Exploits/Ports/default.htm
hope this helped if not post something else

#105589 18/12/04 09:20 AM
Joined: Dec 2002
Posts: 94
K
krunch Offline OP
Babel fish
OP Offline
Babel fish
K
Joined: Dec 2002
Posts: 94
thats just "normal" list of ports

you can asign anything to any port
as u can have a proxy server running on port 80 witch is also the httpd default port
and going off that method, the scanner would think that some1 running a home webserver has an open proxy server running and would ban that ip with its just a httpd running,

what i want to know is if there is a command to send to the ip:port to get header information, so it will reply with http>
etc etc
so it can tell if its a normal service or a proxy server


Lets get dirty

Link Copied to Clipboard