Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite
1

I'm struggling to find a way to retrieve through Google a list of sites having Linux as their server operating system.

Actually, I'd like to be able to test the following command:

nmap -O www.....(website)

Through that command I should be able to know (roughly) if a specific site is running Linux or any other operating system (fingerprinting technique)

In a nutshell, I don't know of a site running Linux but I'd like to find one.

How would you go about it?

I tried to pick up a site and do some port scanning through nmap but I only got results showing Windows as OS.

It's just for study purposes.

Thanks a lot

share|improve this question
1  
Try another site and read the nmap's f... manual! But be care with nmap's options! At all if you harm some public site by flooding or other, you'll be responsible! If for studying, U could build, than attack your own private server! – F. Hauri Dec 26 '12 at 9:18
Thanks for your suggestion..But how can I build my own private server whose Os is Linux...Is there a place online which offers such a service (of course free of charge) ? – g999 Dec 26 '12 at 9:35
1  
I recommend to deploy your own testbed as there are lots of freely available vulnerable websites i.e DVWA etc. All you need is to install web server of your choice and verify it with NMAP or any fingerprinting tool. – Ali Ahmad Dec 26 '12 at 9:56
Nmap runs scanme.nmap.org for this very purpose ... – schroeder Dec 27 '12 at 21:17

3 Answers

up vote 3 down vote

If you actually want to just get a list of which sites run Linux, visit netcraft.com, which gives server types, uptime and a wide range of other statistics.

share|improve this answer
up vote 2 down vote

I doubt the accuracy of HTTP fingerprinting tool, as these attacks are so common that we can mitigate such with application layer firewall. With ModSecurity firewall rules and some configuration tweaks i can make automated HTTP fingerprinting tools think that we are running a Microsoft IIS/6.0 server instead of actual Apache linux server. Following is a Firewall configuration for above stated scenario.

# Change server signature
SecServerSignature "Microsoft-IIS/6.0"

# Add X-Powered-By header to mimic IIS
Header set X-Powered-By "ASP.NET 2.0"
share|improve this answer
1  
A skilled attacker might be able to see through your tricks by turning on verbose mode and analyzing the results more thoroughly. And your answer doesn't exactly answer the question. – Terry Chia Dec 26 '12 at 13:08
Application layer firewall is just an operational security tool to harden your defenses and discourage malicious intent. WAF is actually filtering every request and response to and from the server. Yes to differentiate between WAF response and application response is a difficult task and requires analysis. Difficulty of this task depends upon quality of rules written by the administrator. Currently there is tool available that can do HTTP fingerprinting with 100% reliability. NMAP are actually trying to develop such a tool seclists.org/nmap-dev/2012/q2/319. – Ali Ahmad Dec 26 '12 at 17:50
up vote 2 down vote

It's a bit rude to do testing against someone elses's server without their permission, and also not a very good test because you don't know what they have in place.

Better is to run your own server. This can be done very simply and cheaply. The classic way is to pop over to http://aws.amazon.com and rent an EC2 instance. It's very cheap, and I believe they have a free introductory offer of 750 hours a month that would probably be enough for your needs.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.