How can attacker know the (victim's) router vendor, for testing default passwords, without physical/visual access to it?

  • By connecting to it. The router announces itself. – schroeder Jul 6 '17 at 8:30
  • Paradox detected: "without physical/visual access to it". Please edit your question. – mootmoot Jul 6 '17 at 8:38
  • 1
    @mootmoot what's the paradox? one can have visual access without physical access – schroeder Jul 6 '17 at 8:41
  • @schroeder We will have philosophy question such as "physical connection". – mootmoot Jul 6 '17 at 8:53
  • 1
    @mootmoot I think it is generally understood that sending packets is a logical connection, not a physical one – schroeder Jul 6 '17 at 8:56

Just by scanning with NMAP tool you can know the vendor and other information of that device. Here, I am scanning a Singaporean router with IP and the results are following,

[arif@arif:~]$ sudo nmap -O
Starting Nmap 7.50 ( https://nmap.org ) at 2017-07-06 14:17 +06
Nmap scan report for ae6.singapore2.sin.seabone.net (
Host is up (0.058s latency).
Not shown: 991 closed ports
20/tcp   filtered ftp-data
21/tcp   filtered ftp
22/tcp   filtered ssh
23/tcp   filtered telnet
111/tcp  open     rpcbind
179/tcp  filtered bgp
514/tcp  filtered shell
646/tcp  open     ldp
3221/tcp filtered xnm-clear-text
Device type: router
Running: Juniper JUNOS 9.X
OS CPE: cpe:/o:juniper:junos:9.2r1.10
OS details: Juniper JUNOS 9.2R1.10
Network Distance: 4 hops

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ 
Nmap done: 1 IP address (1 host up) scanned in 9.49 seconds

If you look at this output closely you can see that in the Device heading it says exactly router and in OS details heading it says not only about it's vendor name (Juniper) but with it's version (JUNOS 9.2R1.10). So most of the time it's pretty easy to guess about OS. I am saying guess because some specific security feature can mislead us about OS.

  • what about simply connecting to it? – schroeder Jul 6 '17 at 8:32
  • Yeah, I was missing that part. Sorry – Muhammad Jul 6 '17 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.