Em dùng Nmap for Windows quét IP của một máy tính được kết quả như sau:
Code:
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port3999-TCP:V=4.50%I=7%D=3/28%Time=47EBE52A%P=i686-pc-windows-windows%
SF:r(NULL,D1,"5\.38\.14\0\0\0\0\0\xc1\0\xf5\x04\x1d\x18\xd9#`Z\xef\x1cN\xc
SF:f\xb4\xbf\n\xb0\xed\x0b\x1b\xd2\x13t0\xfa\xf43U\x1fU\x81\xc0\xb7\xe3\xc
SF:4\x03\xc4\xe8h\x90\xd6\xc7\tB\xd1t\xb4\xbd\xdf\xa78\x8eaC\xc2qZ<\xe2\\\
SFf5\xfask\x9d\xeb\x97C\xd3n\xe8\xf7\xf9\xde\xfa\xbe\xfb\x86\xbf\$8\xbf\
SFb6m\xea\xb7\xdeT\xb7\xa8x\xe1U\x92\xed\x14w\xde7-\xef\n\xfd\xfb&\xe0\x
SF:ed<\x1d\$p3/\xfbz8\x98\|\xb9F\x8c\x89\xed\xf1\x0bBQ\xef\x08\xb3\xb2\xf0
SF:\xa1\xce\xa2\xda\x0e\x8d\xbc\xa9l\xd1\xb1%\xf4\xe3\xf6\x97\x93\xef\xb7\
SF02\xea\x1d\x07\xe8\xf2H@>R\x97\xe6Y#\xe9O9\xcb\xea\xbe\x20\]@k\xa4\x07
SF:\xc7\xdc\xc81H\xd2\xac\xb0\x87\xfa~W\xdd\x9a\x9dg\xfb\xfc\0")%r(Generic
SF:Lines,D1,"5\.38\.14\0\0\0\0\0\xc1\0\xf5\x04\x1d\x18\xd9#`Z\xef\x1cN\xcf
SF:\xb4\xbf\n\xb0\xed\x0b\x1b\xd2\x13t0\xfa\xf43U\x1fU\x81\xc0\xb7\xe3\xc4
SF:\x03\xc4\xe8h\x90\xd6\xc7\tB\xd1t\xb4\xbd\xdf\xa78\x8eaC\xc2qZ<\xe2\\\x
SF:f5\xfask\x9d\xeb\x97C\xd3n\xe8\xf7\xf9\xde\xfa\xbe\xfb\x86\xbf\$8\xbf\x
SF:b6m\xea\xb7\xdeT\xb7\xa8x\xe1U\x92\xed\x14w\xde7-\xef\n\xfd\xfb&\xe0\xe
SF:d<\x1d\$p3/\xfbz8\x98\|\xb9F\x8c\x89\xed\xf1\x0bBQ\xef\x08\xb3\xb2\xf0\
SFa1\xce\xa2\xda\x0e\x8d\xbc\xa9l\xd1\xb1%\xf4\xe3\xf6\x97\x93\xef\xb7\x
SF:02\xea\x1d\x07\xe8\xf2H@>R\x97\xe6Y#\xe9O9\xcb\xea\xbe\x20\]@k\xa4\x07\
SFc7\xdc\xc81H\xd2\xac\xb0\x87\xfa~W\xdd\x9a\x9dg\xfb\xfc\0")%r(GetReque
SF:st,E5,"5\.38\.14\0\0\0\0\0\xc1\0\xba\ne:b\xd37\xb2\x98\|\xe8\xffYdw\x08
SF:w\x87\xe7\xf7i%Z\x87{\xf1\xb9Xu\xa0\xc9n\xf4P\xc9i\x11\xd5\x89\x960\x1d
SF:%\xe1j\xc7\x13\xdc{\xbb\xbe\0\xbb\[\"\xc4\x07\xaa\xac\xd9\xdew\xb8\xda\
SFe1\xac\x95\xdbk\\\x07;\x94Y\x88\x0e~\^\0S\xbb\xe4\xd7\x9c\xaf5\^\"\t\x
SF:fe\x19\x9e\xe9W\x0b\xde\xd2\x18X\xd1\xe4\xe5!\xcd\xe0yq\xde&\xf0\x97\x1
SF:9,\]4\x97Y\xbe&\x9b\x80\xf1\xee\xa3\^\xb2\xc0'\x1a\xcb\xc0B\x1a\x91\xa7
SF:\x17\xb4\x8b\xb1\x08\[kV}\x01\xc2n71\+Ro0\x03\xda=\xd5\xa7\x1f\xb0:\\\x
SF:c8\xa4j\xf3\x83\x9a\xc1_\xb3\x13\x82\xf9\xc2o\x14\xbc\x85\x065\x20EH\x1
SF:1%E\x02\x91V\x11\xcf\x82\xed\0\x02\0\0\x002\xc31\x98\x81\xfc\xce\x87\x0
SF:4\x7f\xf2\xc0\^\xfa\x8a\xd3")%r(HTTPOptions,E5,"5\.38\.14\0\0\0\0\0\xc1
SF:\0\+\t\xd5\xec\x80\x9fq\x8f\xd5K\xa7\x933\x97\x85\xcb\\\t\x06\x13\t\xe9
SF\t\x9f~\xc9\r\x17I6\xa42\x11\x05\x1d\x93\xd2F\xe9\xe0A\x1cl\]\xd0\xe5\
SF:^g\x1b\xf7\xba\xa7\xed\xa1\xb8\x18\xcb\x8e\xc3f\xa0O\xce\xb3\x11y\x13\x
SF:0511\x89\x06\(\xab\xf2\xcd\x0b\)\xb3\x11\xe5c\xa6I\x95\xfa\xeb\xbc\xc8y
SF:\xc9\^\x17L\xc1Y\x0c\xff}G\xeb'\xf7\xd3\[\xc2/\$G\x1b\xa1V\xc5\(\r\x99\
SFd3\xae!\xb9\xebm&\x20ce\xad\xac\xaf\x82\xd9\xc6<\xf9\xd9W\x82\x95\xb5\
SF:"\xab\xb3\xaa\xe4\x10\x9f!\xbc\+\xf0\x98Vu\x1a\xb2x\xb0w`\xde\xb7\xc10\
SFbeS\xe0\xe6\xc1\xaf\xa9\xcd\r\xb5\xc6b\xc6Z\xd8q\xa3\"\xe2\xca\xb8\xe0
SF:\xe3\xc2\xa1\xb6U\xd8#N\0\x02\0\0\0I\x99\x1a\x94v\xae\x94\[\x86k\xde\xa
SF:5\xdc\xb7\xfbv");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port4000-TCP:V=4.50%I=7%D=3/28%Time=47EBE52A%P=i686-pc-windows-windows%
SF:r(NULL,D1,"5\.38\.14\0\0\0\0\0\xc1\0>\x06\xbc\xd7\xc4I\x0c\xf8o\xbc\xe9
SF:\xbd\xd1\xe8\xcd\x81Rv\xc2>\x87x\xf8\+\x12\\\x91\x02g\xc6X\xa0\xe9;\x03
SF:\xd6\xdab\xdb\xaa\xac\x12\xa2\xe9\xf5HO~-n\x05\xb9\xb2F\x1f\x0b{\xd6\x8
SF:5;T\x1e_Ds\xdb\x8f1\xa3\xe9{\x8aS\xf8g-\xe4\xe1\xe3\xb6\x19\xaaD\x90a\x
SF:b9\xc7\x0e;\xc4\x97bl4\xb8\x10e4\xf3\x0e\xea\x9c\xb6qr\.\x873\xf7\x88\x
SF:ae\x90\xdf\[\x16\x0b\x95\xe1\xce\*\x8b\xcd\x89\xb9>\x01\x97\x0f83\^_\x9
SF:f\xee\x90\xfe\xf9\x1a\x16\xbf\xa7\x90cx\xfa\xbf\x7f\xd2\x0c\xd1\xdd\xe1
SF:L\xfbaI\xf2\xb1@\xed;\\\xc9\xe2\x0eu\x92\xb6\xd5\x08U\xf9/3\xc5\x166b\x
SF:bf\x04\xbb\x1f\x12\x82\xb8m\x9fq\xe8\xe2\x96R\xdf\x9b\0")%r(GetRequest,
SF:E5,"5\.38\.14\0\0\0\0\0\xc1\0>\x06\xbc\xd7\xc4I\x0c\xf8o\xbc\xe9\xbd\xd
SF:1\xe8\xcd\x81Rv\xc2>\x87x\xf8\+\x12\\\x91\x02g\xc6X\xa0\xe9;\x03\xd6\xd
SF:ab\xdb\xaa\xac\x12\xa2\xe9\xf5HO~-n\x05\xb9\xb2F\x1f\x0b{\xd6\x85;T\x1e
SF:_Ds\xdb\x8f1\xa3\xe9{\x8aS\xf8g-\xe4\xe1\xe3\xb6\x19\xaaD\x90a\xb9\xc7\
SF0e;\xc4\x97bl4\xb8\x10e4\xf3\x0e\xea\x9c\xb6qr\.\x873\xf7\x88\xae\x90\
SFdf\[\x16\x0b\x95\xe1\xce\*\x8b\xcd\x89\xb9>\x01\x97\x0f83\^_\x9f\xee\x
SF:90\xfe\xf9\x1a\x16\xbf\xa7\x90cx\xfa\xbf\x7f\xd2\x0c\xd1\xdd\xe1L\xfbaI
SF:\xf2\xb1@\xed;\\\xc9\xe2\x0eu\x92\xb6\xd5\x08U\xf9/3\xc5\x166b\xbf\x04\
SFbb\x1f\x12\x82\xb8m\x9fq\xe8\xe2\x96R\xdf\x9b\0\x02\0\0\0\x06\x1dI\x9b
SF:\r\x03\xf8\xb4\x83\x83\x96\xec\^/\x191")%r(GenericLines,D1,"5\.38\.14\0
SF:\0\0\0\0\xc1\0\x08\t\|\x8bOB\x02\x8adf~\xe6\x04\xffRE6\xb1\x11\x0f\xdc\
SFa1Y\xa0\x13\xe6\x97y\xc1\xebL\x8ef'}\xb5B\xe2g\xcaP\x08\*c\xb4wWM\xe7\
SFad\xb7\x9f\xed6\x8b\xdf\x94\xa1\xfdUt\xe1o\xab\xd7\xd4\xf2\x88\"\xc7wN
SF:\x1c`\xff\xef\xbf\xcdd\x89d\xeeV\x07F\xd4\x9e\xdaM\xf3\xde\xd6\x93\xfaZ
SF:\?\xfc\xa6\[\xc1Z\xf2}9\xed:\xbeE\xf0\xef3oqm\x861\x8e\x11\xe2\x05\x85\
SF86\x1cz\|V\xd3\xe4X\x86mf\xc7\xba\x8c/\x04\xd2\xa5P\x1e\xef\x8cI\xbb\x
SF:9c\x18Q\x90\+\xb9\xd7\xdeV\x9b\xa9\x13\xe4\x03\x17O\xd6\x1d\x1c\xd6\x14
SF:\x9cfk/\x98\xf3\x95\$xs\xa5P\x15\xda\x0c\x20\xed\x1a\xc0\]b\\\xf6\x90\x
SF:86\xfb=\x9c\0")%r(HTTPOptions,E5,"5\.38\.14\0\0\0\0\0\xc1\0\t\x07\xe6\x
SF:83#\xf8\xefx_\xc0b\$\x94&D\xb4\xdf\rH\xbf\x14\xc9\xa6\]xJ\xc4\xfc\x9f~L
SF:\x1d\x86\xcf\xb9\]\x1d0\xa8\x9c\xe7\x9b\xfa\x8e\xe4\xfc\xbd`W\xe8\x0c\x
SF:d8}\xa4A\x17\xae\xcd\xbd#P\xee\xaci\x16\xe8\xe2\x9c\x1da\xb59\(\xc9\x94
SF:\xae\xc3\^\xaf\xa6\x90\xb0\x209\xc0T\xffW\x8c\xea\x16\xcd\\\xbd\x10S\x8
SF:a\.q\xee!\xaa\x11\xd7\xa3\x0bp\.#\|\xee\x97\xdd\x1by\xd4\x9e}\x98r\xc0\
SFb7\)A1\xcf\x11\x12\x04%\xfdL\xb5\xa8\x1c\xad\xba-\xaeI0\xe8G\x12\x14\x
SF:85u1\x8cY\xd3Y\x9b\xc8\xe31_\x0c\xde\xbfJ\|Y\x89q\xb2\xe7\t:\xb3\xc2\xb
SF:49f\x07\x9c\xae\xfe\xa9\x17\x8a\xaa\xa5EZ\x89\xfb7\xd8\\{\xa8\xd6\xe3\0
SF:\x02\0\0\0\x9b\x99\x1a\x94v\xae\x94\[\x86k\xde\xa5\xd6\xb3\xfbv");
MAC Address: 00:0C:29:25:26:7F (VMware)
Device type: general purpose
Running: Microsoft Windows 2000|XP|2003
OS details: Microsoft Windows 2000 Server SP3 or SP4, Microsoft Windows XP SP2 or Windows Server 2003 SP0/SP1
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=262 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OS: Windows
Host script results:
|_ NBSTAT: NetBIOS name: VIRTUALPC, NetBIOS MAC: 00:0C:29:25:26:7F
|_ Discover OS Version over NetBIOS and SMB: Windows XP
//////////
Em chỉ đoán được rằng đây là các gói HTTP, nhưng chưa thể hiểu được chứa thông tin gì. Mong các cao thủ giúp đỡ em phân tích đoạn này. Nếu có thể hướng dẫn luôn cho em tool để decode cái đoạn này với.