>> Welcome to the Nmap OS
>> detection and fingerprinting lab.
>> I already told you what OS detection and
fingerprinting is in Nmap and why it's relevant,
so let's get right to it.
The only thing I wanted to mention is that
when scans take a really long time,
I'll cut the video in order to save you some time.
But I'll try to let you know when a scan takes
a while so that you can be
prepared if you decide to run them along with me.
To start with, just to get our bearings,
I'm going to do a ping sweep.
We'll do a nmap-sn of my local network.
You've seen this before.
I've got 25 hosts up and you can
see all their MAC addresses
and IP addresses and so forth.
Again, like I have in the past,
I'm going to stick to this 192.168.1.10,
which is a Dell machine,
happens to be a Dell server.
Let me clear the screen.
We'll just start out with the main OS detection scan,
which is nmap -O.
This scan doesn't take very long,
and there you have it.
I'll scroll up so that you can see
the results of the port scan, and there you have it.
Took less than five seconds and shows that it's running
Microsoft Windows 2012 or 7 or 8.1,
and the CPE here is Server 2012 R2.
The server is actually running
Server 2012 R2 Essentials,
so it's pretty close to accurate.
What I wanted to show you next was adding
the -v for verbosity option.
We've seen it before,
>> but when you're doing OS detection,
>> it's nice to see the output
as it's determining what's going on.
We'll do a nmap -O -v.
You can see what it's doing as it's doing it.
Takes the same amount of time,
so it doesn't affect the time.
But you get to see what it's doing as going along.
One thing I wanted to show you is
that one thing that verbosity adds is uptime,
and that's actually very accurate.
Verbosity not only shows
>> you details as it's going along,
>> but it also does add
some extra information that
you otherwise wouldn't have known.
Now, I'm going to show you one of
my favorite OS discovery strategies,
and this is especially effective on a Windows network
because SMB is so prevalent and that is nmap -O.
I'll actually leave the verbosity off this time.
It's running an NSE script
called smb-os-discovery
against this host that we just scanned.
I'm running OS detection,
even though you don't have to run the OS detection.
We've already done that.
It's going to provide the same
>> information it did before,
>> but it's going to add some details
>> using this NSE script.
>> I'm not going to scroll all the way up,
but what I want to show you is
the script results here, smb-os-discovery.
Like I said before,
this server is actually a Server 2012 R2 Essentials,
and the regular OS detection scan
didn't pick up on that detail,
but the smb-os-discovery script scan did.
Also, it gives me the computer's name,
which you can obtain doing other things.
It tells me the domain name and
the fully qualified domain name
>> and also the system time.
>> That's a really good scan to
remember in case you are scanning a Windows network.
I'll clear the screen again.
Now I want to do a scan that we just did,
but I'm going to do it against a different target
and that is, nmap -O -v.
This is against the Cisco switch,
it's a layer 2 traditional switch.
What I want you to see is,
it's doing this OS detection,
it's showing you the number of tries against
the target. I'll scroll up.
It did determine the MAC address,
it knows it's a Cisco device,
but it shows you no exact matches for
host and gives you
the fingerprint in case you want to submit it.
But it also shows you how many tries it
attempted against that device to determine the OS.
The reason why I wanted to show you that is because
we talked about an option called max-os-tries.
I'll show you what that does.
We'll do a nmap -O.
I've added the --max-os-tries,
and I put the number 1 there against the same target.
Before it tried five times to determine
the OS of the host.
That time you saw, I think,
if you were watching carefully,
initiating OS detection try number 1,
so it only tried it one time.
That's one way that you can make your scans faster,
and theoretically, it's not going to be as accurate.
But in this case,
I'm in a local network, so in most cases,
on a local area network,
limiting the number of
tries to just one is going to be sufficient.
Again, it says no exact OS matches for host.
>> We're going to do a very similar scan again.
Clear the screen, I'll do the up arrow.
This time what we're going to do
is I'll remove the verbosity.
I'm going to add another
command line switch that we talked about and that
is OS scan guess.
Again, it's the same target.
We're doing a Mac OS tries of
one and I'm tallying in map to
guess what operating system it
is based on that one try against the target.
Before it wasn't able to determine it,
even though it did know that
the MAC address was a Cisco device.
Here's the fingerprint. It says,
"No exact OS match for host."
But right above that,
it says, "Aggressive OS guesses."
It says, "Cisco Catalyst 2950 series switch 97 percent,
2950 switch running iOS 12.1 96 percent."
That is accurate.
This happens to be a Cisco 2950 series switch
and it is running iOS version
12.1 and with the MAC address
showing that it's a Cisco device, so it's accurate.
That's very useful information in case you're doing
inventory or getting ready for a penetration test.
Especially because this is iOS 12.1,
which has some holes. Clear the screen again.
Now we're going to do another really useful strategy
against hosts.
I'll choose a different one.
This time I'm going to hit my firewall.
That is combining avert
application and service version detection
with the OS detection.
Do a Nmap -sV, like in the last lesson,
-O against my firewall.
The scan takes a little bit of time. There you have it.
I'll scroll up so you can see the results.
The cool thing about this is that it
not only did an OS detection,
which I'll show you in a second,
but it also did a service
and application version detection at the same time.
That's a nice scanned around to
save you some time maybe,
it's a little bit noisier.
But it showed me the work group that this device is in.
Shows me the versions of all the services running on
these ports and it
shows me the operating system
running on this device also.
This is actually a Linksys device as a firewall
shows Belkin because I think
that Belkin bought out Linksys from Cisco.
It does show the CPE here also.
Shows you the kernel of Linux that it's running.
I want to add to that and I'm culminating with the,
probably one of the best scans Nmap
will run against a single host.
It does take a long time,
so I will cut the video even longer than
this last one which was 47.77 seconds.
But that is an Nmap -A 192.168.1.254.
This is what I call advanced and aggressive scan.
I will have to cut the video on this.
I think it takes about a minute to a minute and a half.
But I think that you'll be very
satisfied and amazed at the results.
There you have it. Took a minute to
run that scan against the single host.
Will scroll up and I'll show you
>> the details of the scan.
>> It resolved its name and then it did a service and
application version detection and gave
even some additional details because
it ran a script scan as well.
Even did a little bit of a banner grab.
Know it's a Linksys smart Wi-Fi device
which the previous scan did not
show and so forth.
You see that the -A gives you a lot of details.
Really what I want to show you was in order to get
those same results if you didn't use a -A,
you will have to do a command like this.
Basically, you'd have to do an Nmap -sS for a sin scan,
sC for a script scan -sV for
an application and service version detection -O
for an OS detection,
--traceroute in order
to do a traceroute and then your target.
I'm not going to show you the results.
You can run it on your own,
but I assure you that the results
are almost exactly the same as the -A.
But it just takes
a lot more command line options
>> to get the same results.
>> Or if I wanted to make it even longer,
I could do something like that.
Which basically it does a script scan of using
all of the default scripts. There you have it.
That's the end of the OS detection lab.
I look forward to seeing you in the next video.
In this lesson, we talked about
what operating system detection and fingerprinting is.
Second, we discussed why it is
both relevant and important.
Third, we talked about when and how to use it,
including the most important command line
>> option you need to know.
>> Then I provided a couple of
other command line options that are helpful.
Finally, we wrapped up this lesson with a lab
on operating system detection and fingerprinting.
Again, thanks so much for
working through this lesson with me.
I'll see you in the next one.