OS Detection

Yeah, we are in Nmap help again, as usual.

And we are going to talk about OS detection and the main switch is the -O, pop onto here.

And that is the most basic of commands with a minus capital O, so let's run this now.

And we can see the OS detection here so we can see Linux and Linux kernel, OS details' Linux 3.2 to 3.16.

So as you can see, Nmap supports remote OS detection using TCP IP stack, fingerprinting Nmap sends a series of TCP and UDP packets to the remote host and examines the response.

And if we pop over. nano the Nmap. OS database.

I scroll down a little bit here. We'll see some patterns at performing dozens of tests, such as TCP I S N sampling, TCP options, support and ordering.

IP ID sampling, initial window size check Nmap compares the results to this Nmap OS DB database of known OS fingerprints.

If Nmap is unable to get the OS of the machine because it's not matching anything in here and the conditions are still good.

I, at least one port is open and one port is closed Nmap will provide a URL that you can submit with a fingerprint.

If you know what the OS is, that is running just the same as what I showed you with the version detection let's pop over to here, and I've added -V here to give us a little bit of extra information.

OS detection enables some other tests which may use of information that is gathered during the process.

Anyway, during the process for OS detection, one of these is TCP sequence predictability classifications, which you can see.

Here, this measures, approximately how hard it is to establish a forged TCP connection against the remote host is useful for exploiting source IP based trust relationships, like with all log-in with firewall, firewall, filtering, et cetera, or finding the source of an attack with ideal scan.

Now this sort of spoofing is rarely performed anymore and not so many machines are still vulnerable to.

And you can see there, the difficulty number there, which is the 1 8 1. In this example, this is based on a statistical sampling and may fluctuate.

And you'll get some sort of piffy comment here, which indicates how easy or hard that will be.

Good luck indicating sarcastically, that you will need it in order to do it.

And that's what you'll find in most cases now is hard to find a machine where you can exploit the source IP based trust relationships.

Using a TCP IP sequence prediction, vulnerability, but it's good to know what that is.

Also when verbose mode is enabled, we can say here yet, the IP ID sequence generation, many systems unwittingly give away sensitive information about their traffic levels based on how they generate the 16 bit ID field in IP packets and some machines.

You'll see, as a response here are in the incremental class, which means that they increment the ID field in the IP header for each packet, they send this makes them vulnerable to this, makes them vulnerable to several advanced information gathering and spoofing attacks.

But there's not often that you'll see incremental as the class.

If you want to understand more about the IP ID sequence, then check out this page here. Has popped back here.

And if we look at this. Uptime guests is another bit of extra information enabled bios detection, and that is guessing the Targus uptime.

This uses the TCP timestamp option RFC 1323 to guess when a machine was last rebooted and let's pop over here.

Now another option around OS detection is minus minus OS scan minus limit.

Which means limit OS detection to promising targets.

OS detection is far more effective if at least one open and one close TCP port found.

If you use LS limit Nmap will not try OS detection against hosts that do not meet this criteria.

So this can save time and particularly.

When you're using this, which if you remember, is the no discovery scanning, which means it will scan all IP addresses and do no discovery to see whether they are active. It will just scan them anyway.

So OS limit is particularly useful when you have no discovery scanning set and you're scanning many hosts and obviously only matters when you have O S detection requested in the first instance.

So let's all look at the results from the scan, and we can see this host 23 here, they've skipped the OS detection and that's due to an absence of open or perhaps closed port. Basically.

There's not enough ports open for it to be able to detect what the operating system might be.

But even if the arrest detection doesn't work, you can look for other clues.

We can see here, we've got an apple Mac or rather an apple Mac address.

Indicating that that's probably some sort of apple device.

In fact, it is very likely to be if that's what the Mac is, we can see here, we have some sort of VX works as attached to the HP printer or potentially a vocality basics for wire VoIP gateway.

This is actually a HP printer.

So it has guessed one of its guesses correctly.

And with a Mac address, that's pretty much telling us for certain plus the port.

We can see that that definitely is a printer.

And we can see here aggressive OS guess that it's four to gate and it's set telling us here that it is just guessing that it's four to gate.

And in that instance, it is wrong because that is actually an iPhone.

So there you go. You can see the sort of results that you can get from OS detection.

Let's click on here and we can have this minus minus fuzzy option.

You can also have minus minus OS scan minus guests.

And this is the guest OS detection results option, which makes Nmap guests more aggressively.

Nmap will still tell you when an imperfect match is printed, as you've just previously seen, And displays his confidence level represents as a percentage for each guest.

So essentially it guesses more aggressively. Let's have a look at this option here.

So fuzzy from last time, but we've also got minus max minus OS minus tries, and then a number this is to set the maximum number of OS detection tries against a target when Nmap performs OS detection against a target and fails to find a perfect match.

It usually repeats the attempt by default.

Nmap tries five times. If conditions are favorable OS detections submission and twice when conditions aren't good specifying a lower number for this max OS tries such as one speeds up Nmap because it does less dry.

There obviously you miss out on retries, which could potentially identify the OS.

So there you go. That is the OS detection section, and you can find the help with -H as normal with Nmap Nmap -H.