"Most of todays tools for fingerprinting are focusing on server-side
services. Well-known and widely-accepted implementations of such
utilities are available for http web services, smtp mail server, ftp
servers and even telnet daemons. Of course, many attack scenarios are
focusing on server-side attacks.
Client-based attacks, especially targeting web clients, are becoming
more and more popular. Browser-targeted attacks, drive-by pharming and
web-based phishing provide a broad aspect of threats during surfing in
the world wide web. Attacker might initialize and optimize their attacks
by fingerprinting the target application to find the best possible way
to compromise the client.
The browserrecon project is going to prove, that client-side
fingerprinting is possible and useful too. In this particular
implementation, currently available in php only, the given web browser
is identified by the used http requests. Similar to the http
fingerprinting provided within httprecon
(http://www.computec.ch/projekte/httprecon/) the header lines and values
are analyzed and compared to a fingerprint database.
The current implementation of browserrecon is provided as a php script
and ready for live testing on the project web site. However, all
web-based scripting languages that are able to access the http headers
sent by the client are able to provide the same functionality. Further
ports to ASP.NET, JSP and classic CGI are possible. Even the web server
itself or an inline device (e.g. a sniffer or a firewall) might be able
to do the same fingerprinting of the http request behavior.
A very similar approach for client-side application fingerprinting can
be applied to other services and clients too. For example mail clients
can be identified by their individual smtp and pop3 command chains. Or
ftp clients might be determined by their specific command sequences.
"
