I would like to modify Win OS banner to defeat OS detection from scanning tools like Nmap for example. Although, I know that Nmap does not take into account just the banner to do OS detection.

  • 4
    What is "Win OS banner"? – multithr3at3d Mar 28 '18 at 23:02
  • @multithr3at3d I think he wants a way to avoid the OS detection by making some changes into windows. There used to be a way by modifying the registry of windows, but I am not sure if it exists anymore. – tech_enthusiast Mar 29 '18 at 2:25

I suppose you're talking about the OS Fingerprint, which used to be a simple OS File that you could modify or replace.

However, with newer scan techniques, and combined scan techniques, modification of the fingerprint will no longer be sufficient to effectively hide your OS from nmap.

For example, the scanner looks at some TCP Properties, like the TTL and TCP Window size:

Operating System                      Time To Live  TCP Window Size
Linux (Kernel 2.4 and 2.6)            64            5840
Google Linux                          64            5720
FreeBSD                               64            65535
Windows XP                            128           65535
Windows Vista and 7 (Server 2008)     128           8192
iOS 12.4 (Cisco Routers)              255           4128

Then again, there's also "logic", if you have IIS or Windows RDS running, you're probably running Windows, if an NGINX banner is found, you're likely running Linux.

So in order to effectively hide your operating system from an attacker, you will need to hide banners from several services in order to get the desired effect.

Best would be to perform scans yourself, and take down identifiable banners one by one.

  • 1
    One way would be to virtualize the system you want to appear as and have it bind directly to the network interface. That would allow trivial fingerprint spoofability at the expense of some context switching and virtualized network stack overhead. – forest Mar 31 '18 at 5:46
  • True, good call. However, the 'real' system will still need to have ports open that can leak info. So OP should still check the banners on those. Or even the mixed setup you describe can be guessed. – Nomad Mar 31 '18 at 12:00
  • 1
    That's true. I was thinking more of mitigating networking stack fingerprinting in particular, as application-level fingerprinting is much easier to solve on a case-by-case basis. – forest Apr 1 '18 at 1:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.