This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.

--0-1461842026-1142414760=:2294
Content-Type: TEXT/PLAIN; charset=iso-8859-2; format=flowed
Content-Transfer-Encoding: QUOTED-PRINTABLE

I've received a couple of off-list replies. See my comments in-line.

On Tue, 14 Mar 2006, Martin Ma=E8ok wrote:

> Have you verified that the sequence is global and not only per peer? The=
=20
> latter would mean that "vuln" can't be used as a middle-man for IDLE=20
> scanning...

Yeah, of course i've verified that (see below).

On Tue, 14 Mar 2006, Cody Tubbs wrote:

> Unless you're using the syn/ack flags to localhost, other hosts should=20
> not be replying (I can't seem to reproduce this on any of the hosts I've=
=20
> tried, accept ofcourse on localhost). What is a host(s) you've=20
> successfully tried this towards that's not localhost? Thanks.

Not sure i fully understand your comments... Anyway, here's an host=20
showing the flawed behaviour (Gentoo Linux 2.6.14-gentoo-r5 + grsec):

root@pandora:~# hping -SA -c 3 research.mediaservice.net -p 80
HPING research.mediaservice.net (eth0 82.56.144.13): SA set, 40 headers +=
=20
0 data bytes
len=3D46 ip=3D82.56.144.13 ttl=3D59 DF id=3D48842 sport=3D80 flags=3DR seq=
=3D0 win=3D0=20
rtt=3D57.4 ms
len=3D46 ip=3D82.56.144.13 ttl=3D59 DF id=3D48843 sport=3D80 flags=3DR seq=
=3D1 win=3D0=20
rtt=3D57.8 ms
len=3D46 ip=3D82.56.144.13 ttl=3D59 DF id=3D48845 sport=3D80 flags=3DR seq=
=3D2 win=3D0=20
rtt=3D57.6 ms

--- research.mediaservice.net hping statistic ---
3 packets tramitted, 3 packets received, 0% packet loss
round-trip min/avg/max =3D 57.4/57.6/57.8 ms
root@charon:~# hping -SA -c 3 research.mediaservice.net -p 80
HPING research.mediaservice.net (dc0 82.56.144.13): SA set, 40 headers + 0=
=20
data bytes
len=3D46 ip=3D82.56.144.13 ttl=3D59 DF id=3D48850 sport=3D80 flags=3DR seq=
=3D0 win=3D0=20
rtt=3D53.7 ms
len=3D46 ip=3D82.56.144.13 ttl=3D59 DF id=3D48851 sport=3D80 flags=3DR seq=
=3D1 win=3D0=20
rtt=3D56.3 ms
len=3D46 ip=3D82.56.144.13 ttl=3D59 DF id=3D48857 sport=3D80 flags=3DR seq=
=3D2 win=3D0=20
rtt=3D59.1 ms

--- research.mediaservice.net hping statistic ---
3 packets tramitted, 3 packets received, 0% packet loss
round-trip min/avg/max =3D 53.7/56.4/59.1 ms

Cheers,

--=20
Marco Ivaldi
Antifork Research, Inc. http://0xdeadbeef.info/
3B05 C9C5 A2DE C3D7 4233 0394 EF85 2008 DBFD B707

--0-1461842026-1142414760=:2294--