I have recently completed CEH exam and am planning to enroll myself for OSCP certification. I did research on penetration testing and read penetration testing: A hands-on introduction to hacking written by Georgia Weidman. But I am not able to understand one thing; how to determine the exploit to gain access to different machines?

For example to gain access to Windows XP machine there will be plenty of exploits and for Linux as well. So how to conclude that certain exploit can be used to gain access to the servers?

I am in learning phase of penetration testing. Any help would be really appreciated.

  • 1
    the "info gathering" and "enumeration" steps
    – schroeder
    Dec 18, 2016 at 15:58
  • The more you enumerate...The more you know about the target machine and then you can easily determine possible vulnerabilities that you can exploit using well known exploit code.
    – Shiv Sahni
    Feb 22, 2018 at 17:59

2 Answers 2


I am pretty sure your book will have discussed this as well. Penetration testing is more about gathered information than actually using tools and programs to get the job done. To a certain degree these steps are involved; gather information, analyse situation, prepare strategy, execute. Obviously the last is least important.

Gather information: Who and what is the target? What do we already know? Can we exclude systems, methods, tools? What do we need to gain more info? Who to contact?

Analyse situation: Do we notice strange patterns, files, responses? Do we have a clear image about the internals of the system? Are there obvious problems, weaknesses, exploits?

Prepare strategy: What is the best way to reach our goal with the information that we have? Can we prepare a plan for attack, and a backup plan? How to deal with unexpected situations? Who to contact?

Execute: Execute the plan.

Your book may have different steps, but they at least involve the information gathering part.


Software fingerprinting

There are various ways to determine what software and what versions of it are running on the target computer - for example, a machine "listening" on TCP 443 port is more likely to be a Linux machine and less likely to be a Windows XP computer; also, some connections will show the name and version of the particular server software, which can also be a good indicator of the operating system. You might start learning from nmap basics e.g. https://nmap.org/book/man-os-detection.html

Blind attacks

A possible but "noisy" (easier to detect) approach is simply to attempt a particular exploit - if it succeeds, then obviously the target was running the vulnerable version.

  • Port 443 is the standard HTTPS port. Lots and lots of operating systems can be used as web servers. Also, you would be needing to look for vulns in the web server, not so much the OS. And I think the term you are looking for is 'banner grabbing' to identify the service (not the OS).
    – schroeder
    Dec 19, 2016 at 7:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .