12

If you can send packets to the target machine, use nmap -O, which provides OS fingerprinting. If you can eavesdrop/intercept network traffic with the target machine, use pof, a tool for passive OS fingerprinting. You didn't provide much information about what are your constraints or why the standard tools (like nmap or pof) didn't work for you. Therefore, ...


10

Message signing, in this context, refers to SMB (Server Message Block) signing. Server Message Block (SMB) is a common Windows "application-layer" network protocol, and signing is a feature that allows SMB communications to be digitally "signed" at the "packet-level". The subsequent "signature" provides a mechanism by which a recipient can verify the ...


10

What you're referring to is fingerprinting - the act of identifying a system based on certain properties it has. Modern fingerprinting techniques involve quite a few tests: MAC address range How the OS responds to certain packet flags (e.g. unexpected TCP RST+FIN) Open ports and available services (e.g. remote X and SSH ports open implies it's not Windows) ...


7

Like when doing car maintenance, when you know which constructor, you will take the right maintenance manual (Don't try to repair a Ford Granada with the manual of a Honda civic). When trying to break a particular system, you will browse for known exploit that could help you for this particular system. Every net servers (From Sendmail to Apache, with Samba,...


6

While Android is the "official" OS on the device, the underlying OS on all Android phones is Linux. It's also the most popular Linux OS currently in use on smartphones. So if you see a phone that gets identified as running Linux, then it's probably Android. The catch is that Android phones typically have NO network listening ports open at all, unless there'...


6

First, the theory OS fingerprinting works by examining the quirks about how a given computer responds to network traffic. While RFCs specify a lot about TCP/IP stack behavior, some of the details or defaults may not be officially specified, and some OSes may deviate slightly even in prescribed behavior. Since the TCP/IP stack low-level behavior is generally ...


5

Go throughout this article about remote OS foot printing. http://nmap.org/book/osdetect.html


4

Can a website really fake a response given to a network scanner? Yes, but very few intentially fake responses. However, that doesn't mean you won't get incorrect fingerprint results on a regular basis; there are more common reasons for incorrect results. Many network scanners will have invalid responses due to just configuration changes from the OS's ...


3

OS detection goes a lot further, using all kind of data of the IP and TCP headers fields. If you're into reading, "Silence on the Wire" by Michal Zalewski addresses a lot on this topic.


3

The fingerprint for this match in the nmap-os-db file looks like this: # GS-Z3 Data logger, connected to an Energy Display Meter offered by www.energydisplaymeter.co.uk. BGB WebRTU Z3. Firmware Version : 2.05.03 (19), Config Filename: BGBConfig_07_01.bin Fingerprint British Gas GS-Z3 data logger Class British Gas | embedded || storage-misc SEQ(CI=I%II=RI) ...


3

xprobe2's fingerprints haven't been updated in years, so it isn't going to give you accurate results on a newer OS. I believe it was released back in 2005 time frame. Nothing is ever going to be 100% accurate. As noted in other threads, you can tweak the underlying systems banners (fool passive os fingerprinting tools), tweak its IP stack (fool both ...


3

For answering question's title: Yes, upto 90%, as nmap said. And for your points: Yes, that's job of honey pots No. (100%, surely no. 100% don't exist anyway!) honeypot are fake servers that work to present as any kind of existing system, in the hope an attacker would try to going on. From there, a lot of mechanism will ensure that attacker believe he is ...


2

What tools like nmap and xprobe do is trying to contact services on the machine, looking for open ports, seeing if and what they reply to certain queries. All of this can of course be controlled by the server you are contacting -- those can tell your analysis tool whatever they want. So no, there is no 100% method of detecting the running OS by probing a ...


2

Knowing the exact version of the web server (and application server and DBMS) helps you a lot when performing a test. First and foremost, it helps you when checking for public exploits and vulnerabilities. Let's look at a famous example: kingcope's killapache.pl. The script targets a specific vulnerability found in several versions of Apache HTTP Server, ...


2

From a passive OS fingerprinting stand point you have 2 main ways to differentiate the Android OS while it is on a wifi network. Use the User Agent on the web client at noted in another answer. This is fairly straight forward on earlier versions to get the exact version. As you got into the 2.0 and later ones you could also use the name, such as ECLAIR, ...


2

It doesn't alway work, but you can simply look at the headers that a webserver sends (notice the <=========<<<< below). None of the answers will get you 100% assurance, but combining methods will improve your results: $ wget -SO /dev/null 'http://microsoft.com/' --2012-12-31 15:27:27-- http://microsoft.com/ Resolving microsoft.com (microsoft....


2

Browser fingerprinting does not go so far as to reach into the computer name Fingerprinting does not reach into secured data areas, so your stored passwords are safe from this technique. panopticlick does not appear to disclose what updates they have made, so it is not possible to determine how accurate it is against the most modern techniques. Edit 4. Most ...


2

I've already written an answer to another question that details all the reasons a fingerprint may be non-ideal, but the short answer is yes, Nmap requires a closed TCP port to get the best match. But I'd guess that there are other things interfering with your scan if it's showing Nginx running on Windows CE. Based on your output, I'd guess that the first ...


2

Lee Brotherston spoke at DerbyCon 2015 on Stealthier Attacks and Smarter Defending with TLS Fingerprinting -- slides -- video. He also released code to go along with the talk -- https://github.com/LeeBrotherston/tls-fingerprinting/tree/master/fingerprintls The below is taken from his website -- http://blog.squarelemon.com/tls-fingerprinting/ Transport ...


2

Cloudflare is notoriously unfriendly towards Tor users. Most Cloudflare hosted sites becomes quite patchy when accessed through Tor as Cloudflare rates Tor users as high risk users. It's possible your scraping or the site admin triggered "I'm under attack" mode, which increases Cloudflare's vigilance while it's active.


2

No, there is not. While fingerprinting can be done by actively providing the browser with a resource that will allow for fingerprinting, it is also possible to fingerprint a client entirely passively. For example, the specific order that client headers are transmitted in gives away the web client you are using. Even if you spoof various headers like accept ...


2

Secure enclave doesn't really do any call back to web servers since Touch ID's a replacement for local passcode, and not directly tied with any third-party service. I think in order to enable using touch ID inside an app like Paypal, you need to have already logged into Paypal using your ID and password. Then enabling touch ID basically ties this token with ...


1

Most applications that issue DNS queries do so through common OS-specific libraries. There was a recent vulnerability that impacted multiple linux distributions: https://access.redhat.com/articles/2161461 There is a body of work on fingerprinting OSes by the DNS traffic they initiate, e.g. http://intrusion-detection.org/papers/Matsunaka13DNSFingerprint....


1

The "fingerprint" does not actually include any personal or user-specific information; rather, it pretty much just consists of a bunch of technical information about your browser/OS - for example, your browser version number, what types of compression your browser supports, what types of plugins your browser has installed and their version numbers, system ...


1

OS fingerprinting also detects OS depending implementation specifics in network responses. A simply port block will not work. For these specific topic an application proxy with a different OS could make your Windows PC invisible.


1

I checked out Fingerbank's fp file and the fingerprints are the same fingerprints from 3.09b distribution. The number in the labels relates to the id of the device table in the downloadable fingerbank sqlite database, so these can be easily cross referenced but provide less detailed information than the labels in the 3.09b fp file. Fingerbank maintain a ...


1

Yes, you will find a fp-file on this site: https://fingerbank.inverse.ca/download. The fingerprints are readable, but the labels of the operating systems are missing. So it's not really good. I hope they will update this db with actual values and correct label from the contributors. Also the actual version of p0f have some new more fingerprints (http://...


1

I suspect it is looking at the user agent in your http request. Try setting the user agent in your HTTP request to Windows NT 5.1 Reference: http://msdn.microsoft.com/en-us/library/ms537503(v=vs.85).aspx If you don't want to do this manually, there are a number of tools out there that will let you specify this point/click style. Here is a good article ...


1

It's considered one of the things to certainly test according to the owasp testing guide. If the server is advertising the version number, an attacker can reduce his scope of attacks significantly. Refer to https://www.owasp.org/index.php/Information_Leakage


1

Server names may be useful, depending on what the name is. For example, if the server name is "db3", then its role is probably a database server, while if it's name is "dev1", then it's probably a development server. What does that tell you? It might tell you which one to attack first. Alternately, if it contains a real domain name, then that might clue ...


Only top voted, non community-wiki answers of a minimum length are eligible