So One of Nmap's best-­known features is remote OS detection using TCP/IP stack fingerprinting.
. Nmap sends a series of TCP and UDP packets to the remote host and examines practically every bit in
the response.
After performing dozens of tests such as TCP ISN sampling, TCP options support and ordering, IP ID
sampling, and the initial window size check, Nmap compares the results to its nmap-­os-­db database
of more than 2,600 known OS fingerprints and prints out the OS details
If there is a match. Each fingerprint includes a freeform textual description of the OS, and a classification
which provides the vendor name (e.g. Sun), underlying OS (e.g. Solaris), OS generation
(e.g. 10), and device type (general purpose, router, switch, game console, etc.).OS detection is far more effective
if at least one open and one closed TCP port are found.
Let’s see the OS detection in action: We have to use OS detection with one of the port detection
techniques.
So I use SYN scan in this demo.
The target system is Metasploitable. Let’s choose top 100 ports to make the query faster. Or, do not
give any port, let the Nmap scan
top 1000 ports. That won’t take long. Put uppercase 0 for OS detection and hit enter.
Here is the result of OS detection:
It’s a general purpose device, and running a Linux with the version between 2.6.9 and 2.6.33
If you would like Nmap to be more aggressive to have a more accurate result,
you can use -­osscan -­guess parameter with -­O OS detection parameter.
Now let's scan a Windows system and try to find out the version of the OS.
So here I have a Windows 8 virtual machine.
I want to learn its IP address for the command prompt,
type “ipconfig” and hit enter.
Now let’s go to Kali and test if we can reach the Windows system. First
Ping the system.
Now the system is not responding to the ping requests or we cannot reach the system so second I perform
N mapping scan.
We know how to do it right.
type “nmap -­sn 172.16.99.171” and hit enter. Yes, Nmap says the host is up
So we are able to reach this system.
Now I want to scan the top 10 TCAP ports of this system.
I add the -­-­reason parameter to see the reasons of the results. a• All the ports we scanned are filtered, because
there are no responses from them.
It's not good for us.
I add the OS detection to the latest Nmap query and re-run it.
No, Nmap cannot find the OS details, because it does not have a result set to probe or interrogate.
I would like to open a port on the Windows system and reply the Nmap scans. In Windows 8 VM, I run the IIS
Internet Information Services Manager
and start to host the default website of IIS. Open a web browser and try to reach the website typing the
the IP address of the system into the address bar.
OK.
Web service is up.
Let’s test if I can reach the website from Kali
I go to Kali, open a browser, enter the IP address of the Windows 8 VM and hit enter.
No I cannot.
And I think I know the reason in Windows VM.
Let's look at the firewall,
if HTTP traffic is allowed. I open the firewall. At the upper left corner, I click the “Allow an app or feature
through Windows Firewall” link. Click ”Change Settings” which needs to have admin privileges.
Go to the end of the list. As I thought, HTTP services are not allowed.
Check it, and click OK to apply the changes.
In command prompt, to see the port 80,
I run “netstat -­an” command.
When I come back to Kali,
I see that the page is loaded in the browser.
That means, Kali can reach the port 80 of my Windows 8 VM. Now, in terminal screen,
I want to run SYN scan for the Windows system’s top 10 ports. Here we have an open port now. Let`s
reply the scan with OS detection option.
Now we have the OS detection result. First, Nmap warns us about the results.
It says the results may be unreliable because it couldn’t find a closed port to probe.
Anyway, Nmap makes its best, and
here it says the operating system is one of them:
Windows 2008, Windows 8.1, Windows 7, Windows Phone, or Windows Vista.
Good job.