I'm struggling to find a way to retrieve through Google a list of sites having Linux as their server operating system.

Actually, I'd like to be able to test the following command:

nmap -O www.....(website)

Through that command I should be able to know (roughly) if a specific site is running Linux or any other operating system (fingerprinting technique)

In a nutshell, I don't know of a site running Linux but I'd like to find one.

How would you go about it?

I tried to pick up a site and do some port scanning through nmap but I only got results showing Windows as OS.

It's just for study purposes.

Thanks a lot

  • 1
    Try another site and read the nmap's f... manual! But be care with nmap's options! At all if you harm some public site by flooding or other, you'll be responsible! If for studying, U could build, than attack your own private server! Dec 26, 2012 at 9:18
  • Thanks for your suggestion..But how can I build my own private server whose Os is Linux...Is there a place online which offers such a service (of course free of charge) ?
    – g999
    Dec 26, 2012 at 9:35
  • 1
    I recommend to deploy your own testbed as there are lots of freely available vulnerable websites i.e DVWA etc. All you need is to install web server of your choice and verify it with NMAP or any fingerprinting tool.
    – Ali Ahmad
    Dec 26, 2012 at 9:56
  • Nmap runs scanme.nmap.org for this very purpose ...
    – schroeder
    Dec 27, 2012 at 21:17

3 Answers 3


If you actually want to just get a list of which sites run Linux, visit netcraft.com, which gives server types, uptime and a wide range of other statistics.


It's a bit rude to do testing against someone elses's server without their permission, and also not a very good test because you don't know what they have in place.

Better is to run your own server. This can be done very simply and cheaply. The classic way is to pop over to http://aws.amazon.com and rent an EC2 instance. It's very cheap, and I believe they have a free introductory offer of 750 hours a month that would probably be enough for your needs.


I doubt the accuracy of HTTP fingerprinting tool, as these attacks are so common that we can mitigate such with application layer firewall. With ModSecurity firewall rules and some configuration tweaks i can make automated HTTP fingerprinting tools think that we are running a Microsoft IIS/6.0 server instead of actual Apache linux server. Following is a Firewall configuration for above stated scenario.

# Change server signature
SecServerSignature "Microsoft-IIS/6.0"

# Add X-Powered-By header to mimic IIS
Header set X-Powered-By "ASP.NET 2.0"
  • 1
    A skilled attacker might be able to see through your tricks by turning on verbose mode and analyzing the results more thoroughly. And your answer doesn't exactly answer the question.
    – user10211
    Dec 26, 2012 at 13:08
  • Application layer firewall is just an operational security tool to harden your defenses and discourage malicious intent. WAF is actually filtering every request and response to and from the server. Yes to differentiate between WAF response and application response is a difficult task and requires analysis. Difficulty of this task depends upon quality of rules written by the administrator. Currently there is tool available that can do HTTP fingerprinting with 100% reliability. NMAP are actually trying to develop such a tool seclists.org/nmap-dev/2012/q2/319.
    – Ali Ahmad
    Dec 26, 2012 at 17:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .