Threat level definition
Search:
Home
Bugtraq
Vulnerabilities
Mailing Lists
Jobs
Tools
Beta Programs
News
Infocus
Foundations
Microsoft
Unix
IDS
Incidents
Virus
Pen-Test
Firewalls
Columnists
Mailing Lists
Newsletters
Bugtraq
Focus on IDS
Focus on Linux
Focus on Microsoft
Forensics
Pen-test
Security Basics
Vuln Dev
Vulnerabilities
Jobs
Job Opportunities
Resumes
Job Seekers
Employers
Tools
RSS
News
Vulns
Security Research
Focus on Linux
Back to list
|
Post reply
Re: SMB : TCP/445 impossible to sniff a document sent to be printed to a MS Spooler Server
Aug 25 2005 09:14AM
no_spam me com
Hi,
Nothing to prove, it's already unencrypted :)
You can sniff the print job at two places:
or between PC->print_server on TCP/445
(RAW which is PS/TXT/PCL/ blabla or EMF in this case)
or between Print_server->Printer on TCP/515 (LPR) or TCP/9100(Raw printer)
(PS/TXT/PCL/HPGL/GDI/device dependent language in this case)
Depending on the print processor used in Windows,
sniffed print file (prn) will be either in PCL/TXT/PS/ .... (RAW print processor) or EMF
You have viewer for each type of file (dig internet ...)
For ex:
EMF: EMF VIEWER (Win32)
PS: GHOST SCRIPT/GHOST VIEW (LINUX/Win32)
PCL: REDTITAN or SWIFTVIEW (Win32)
...
HTH
Regards
traxx
=================================
Visit us at www.knowledgecave.com
=================================
[ reply ]
Privacy Statement
Copyright 2008, SecurityFocus
Nothing to prove, it's already unencrypted :)
You can sniff the print job at two places:
or between PC->print_server on TCP/445
(RAW which is PS/TXT/PCL/ blabla or EMF in this case)
or between Print_server->Printer on TCP/515 (LPR) or TCP/9100(Raw printer)
(PS/TXT/PCL/HPGL/GDI/device dependent language in this case)
Depending on the print processor used in Windows,
sniffed print file (prn) will be either in PCL/TXT/PS/ .... (RAW print processor) or EMF
You have viewer for each type of file (dig internet ...)
For ex:
EMF: EMF VIEWER (Win32)
PS: GHOST SCRIPT/GHOST VIEW (LINUX/Win32)
PCL: REDTITAN or SWIFTVIEW (Win32)
...
HTH
Regards
traxx
=================================
Visit us at www.knowledgecave.com
=================================
[ reply ]