Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 25 guests online
 
Advertisement

You are here: Home arrow Resourcesarrow Toolsarrow Fport
EH-Net
May 19, 2013, 05:55:24 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Fport  (Read 5941 times)
0 Members and 1 Guest are viewing this topic.
Kev
Guest
« on: July 30, 2006, 03:26:31 PM »

I really appreciate tools that are complex and have lots of options. In fact if I pay good money for them, it’s something I expect. But there is something about a tool that is simple and free that strikes a chord in me for whatever reason. That’s why I love tools like Netcat and Fport.  Fport is one of the free tools from Foundstone.  To me it’s a great way to see if something mysterious is trying to connect from your computer.  If you’re at a friend’s home and he suspects something odd is happening with his computer and you don’t have your tools, download Fport and check it out.  More than once I have caught a Trojan on someone’s computer that was evading antivirus and was not showing up in the process.

http://www.foundstone.com/
Logged
LSOChris
Guest
« Reply #1 on: July 30, 2006, 09:11:02 PM »

fport can be defeated with hacker defener rootkit
Logged
Kev
Guest
« Reply #2 on: July 30, 2006, 10:32:37 PM »

Yes very true. A well coded root kit is becoming one of the worst nightmares and can defeat more than just little ole fport.  But that doesn’t mean fport doesn’t have a place. No, not as a tool on a critical network! As a quick check on someone’s home computer where there might be a lot of p2p file sharing going on.   Something done on the fly.
Logged
johnhsawyer
Newbie
*
Offline Offline

Posts: 1



View Profile WWW
« Reply #3 on: July 31, 2006, 10:54:13 AM »

Fport is good but I have run into numerous situations where I was gathering volatile data before pulling the plug and had fport return empty results. Some instances were rootkit related while others couldn't be determined. Every time that has happened, though, I've run openports from DiamondCS and it works fine. I also like it's output better because it can add the path of the process listening or look just like fport if you prefer it.

http://www.diamondcs.com.au/openports/

I use netstat, fport, openports and tcpvcon in my custom WFT config.

http://www.foolmoon.net/security/wft/

-jhs
Logged

www.johnhsawyer.com - CISSP GCFA GCIH GCFW
Kev
Guest
« Reply #4 on: July 31, 2006, 02:43:42 PM »

Hey, I like your combination of utilities. Good post and I am sure it will be helpful.
« Last Edit: July 31, 2006, 02:49:46 PM by Kev » Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.06 seconds with 22 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.