Tag Info

Hot answers tagged

13

If you can send packets to the target machine, use nmap -O, which provides OS fingerprinting. If you can eavesdrop/intercept network traffic with the target machine, use pof, a tool for passive OS fingerprinting. You didn't provide much information about what are your constraints or why the standard tools (like nmap or pof) didn't work for you. Therefore, ...


10

What you're referring to is fingerprinting - the act of identifying a system based on certain properties it has. Modern fingerprinting techniques involve quite a few tests: MAC address range How the OS responds to certain packet flags (e.g. unexpected TCP RST+FIN) Open ports and available services (e.g. remote X and SSH ports open implies it's not ...


7

Like when doing car maintenance, when you know which constructor, you will take the right maintenance manual (Don't try to repair a Ford Granada with the manual of a Honda civic). When trying to break a particular system, you will browse for known exploit that could help you for this particular system. Every net servers (From Sendmail to Apache, with ...


6

While Android is the "official" OS on the device, the underlying OS on all Android phones is Linux. It's also the most popular Linux OS currently in use on smartphones. So if you see a phone that gets identified as running Linux, then it's probably Android. The catch is that Android phones typically have NO network listening ports open at all, unless ...


5

First, the theory OS fingerprinting works by examining the quirks about how a given computer responds to network traffic. While RFCs specify a lot about TCP/IP stack behavior, some of the details or defaults may not be officially specified, and some OSes may deviate slightly even in prescribed behavior. Since the TCP/IP stack low-level behavior is generally ...


3

For answering question's title: Yes, upto 90%, as nmap said. And for your points: Yes, that's job of honey pots No. (100%, surely no. 100% don't exist anyway!) honeypot are fake servers that work to present as any kind of existing system, in the hope an attacker would try to going on. From there, a lot of mechanism will ensure that attacker believe he ...


2

Can a website really fake a response given to a network scanner? Yes, but very few intentially fake responses. However, that doesn't mean you won't get incorrect fingerprint results on a regular basis; there are more common reasons for incorrect results. Many network scanners will have invalid responses due to just configuration changes from the ...


2

xprobe2's fingerprints haven't been updated in years, so it isn't going to give you accurate results on a newer OS. I believe it was released back in 2005 time frame. Nothing is ever going to be 100% accurate. As noted in other threads, you can tweak the underlying systems banners (fool passive os fingerprinting tools), tweak its IP stack (fool both ...


2

What tools like nmap and xprobe do is trying to contact services on the machine, looking for open ports, seeing if and what they reply to certain queries. All of this can of course be controlled by the server you are contacting -- those can tell your analysis tool whatever they want. So no, there is no 100% method of detecting the running OS by probing a ...


2

It doesn't alway work, but you can simply look at the headers that a webserver sends (notice the <=========<<<< below). None of the answers will get you 100% assurance, but combining methods will improve your results: $ wget -SO /dev/null 'http://microsoft.com/' --2012-12-31 15:27:27-- http://microsoft.com/ Resolving microsoft.com ...


2

Knowing the exact version of the web server (and application server and DBMS) helps you a lot when performing a test. First and foremost, it helps you when checking for public exploits and vulnerabilities. Let's look at a famous example: kingcope's killapache.pl. The script targets a specific vulnerability found in several versions of Apache HTTP Server, ...


2

Server names may be useful, depending on what the name is. For example, if the server name is "db3", then its role is probably a database server, while if it's name is "dev1", then it's probably a development server. What does that tell you? It might tell you which one to attack first. Alternately, if it contains a real domain name, then that might clue ...


2

From a passive OS fingerprinting stand point you have 2 main ways to differentiate the Android OS while it is on a wifi network. Use the User Agent on the web client at noted in another answer. This is fairly straight forward on earlier versions to get the exact version. As you got into the 2.0 and later ones you could also use the name, such as ...


1

I suspect it is looking at the user agent in your http request. Try setting the user agent in your HTTP request to Windows NT 5.1 Reference: http://msdn.microsoft.com/en-us/library/ms537503(v=vs.85).aspx If you don't want to do this manually, there are a number of tools out there that will let you specify this point/click style. Here is a good article ...


1

It's considered one of the things to certainly test according to the owasp testing guide. If the server is advertising the version number, an attacker can reduce his scope of attacks significantly. Refer to https://www.owasp.org/index.php/Information_Leakage


1

If someone is in the same local network then it is entirely possible they could use the mac address to gain information about your hardware. Changing your MAC address makes a certain amount of sense in some cases, however there are other fingerprinting clues that could give your system away, like how it responds to pings, how it negotiates TCP sessions, etc. ...



Only top voted, non community-wiki answers of a minimum length are eligible