I am taking part in a practice sandbox, and have a pcap file in Wireshark: with the traffic depicting a Vertical Port Scan. Is there anyway to find out the "victim"'s Operating System? The packets are all TCP SYNs, and I tried to filter http GET requests (information can be in User Agent) but there are none. Any help would be much appreciated.

  • An internet search for "passive os fingerprinting" returns many useful results. – multithr3at3d Feb 24 at 17:08
  • 1
    Thank you for teaching me what this technique is called. I am relatively new to the hacker space, as you just might be able to tell ;-). – PrinceOfCreation Feb 24 at 17:27

Probably you should use http://lcamtuf.coredump.cx/p0f3/, this is a good tool for start to understand passive os detection, but bear in mind that there is techniques to fake the results but definitively a good starting point

  • This is certainly one method, but there are plenty of others (even using nmap). – forest Feb 25 at 8:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.