Instructor: Let us check out
how we can figure out what operating system
is our target running just by scanning it with Nmap.
In Nmap, this feature is quite popular,
as they have a database of thousands of known
operating system fingerprints that they compare with
the host that you scan in order to find out
what operating system is it running.
But for this to work,
a target machine must have at least one port open
and one port closed.
Which we need not to worry about since our metasploitable
has both open and closed ports.
However, it could not work for some other targets.
What I'm going to do in this video is,
I'm going to try to scan my metasploitable,
which is running Linux,
and then I will try to scan my Windows 7
virtual machine that I got right here,
and I will try to scan my Windows 10 host machine,
and let us see what results can we get.
Let's see whether Nmap can figure out
what operating systems are they running.
If I go back to my Kali Linux,
and let's go with metasploitable first.
To run the operating system feature,
we must use sudo and after nmap, we specify dash O,
for discovery of operating system.
Then we specify the IP address.
And if I specify the IP address on my metabolizable first,
press enter, type in my password.
It will take just a few seconds.
And down in the results, we can see the OS testing.
It tells us right here that metabolizable is running Linux.
And down here, in the OS details,
it tells us which version exactly is it running
and how many hops is the target distance from us.
It says one, which means host is inside of our network.
And besides all of this,
it also tells us that the machine that we are scanning
is a virtual machine, as we can see right here.
It managed to figure this out by the MAC address
that metabolizable has, since virtual box machines
have MAC addresses that start the same.
And these are these three first numbers.
This is really interesting because
it can sometimes help us to realize that our target
is an actual virtual machine and not a physical machine,
which could possibly indicate that we are
scanning a honey pot,
which is usually a purposely vulnerable virtual environment
that is used to lure in hackers in order to
find out whether they're being attacked.
This is because usually an attacker
will go for the most vulnerable machine first,
and that's how they catch him.
That vulnerable machine could possibly
be put there on purpose.
So for our metabolizable, we got the correct result.
It tells us that it is running Linux, which is correct.
Down here it even tells us
which version of Linux is it running.
And we can also see right here, by the MAC address,
that this is a virtual machine.
So we got a lot of useful results for metasploitable.
Let's try with my Windows 10 physical machine.
So if I type sudo nmap dash O.
And to scan my physical machine,
I must check the IP address inside of my command prompt.
If I type IP config,
it will tell me that my IP address is 192.168.1.7.
Let us type it in, 192.168.1.7,
and run this scan.
It should also take just a few seconds.
Once again, you can check at what percentage is it at
by pressing the upper arrow key and it's currently 81% done.
So let's just wait for the remaining few seconds to finish.
And it'll tell me right here that
it didn't manage to discover OS details.
Now why is that?
Well, because we can see right here,
all thousand canned ports are either closed or filtered.
And remember, to discover operating system,
we need at least one open port and one closed port.
In this case, there is really nothing that we can do
to discover operating system with Nmap,
since all ports seem to be filtered.
Let's try the same of Windows 7 virtual machine.
I know for a fact that the Windows 7 virtual machine
has one port open.
So let's see whether it'll manage to figure out
the operating system on that machine.
If I type sudo nmap dash O,
and I already typed IP config in my Windows 7,
the IP addresses 192.168.1.14.
Let's specify it right here.
Let's wait for this to finish.
And it gives us bunch of OS details.
Up here, we have a warning that says,
results may be unreliable because we could not find
at least one open port and one closed port.
It did manage to, however, find one open port,
which is this port 445,
but all the other ports are filtered.
However, based on this one open port,
it tried to guess what operating system it has,
and it was relatively close.
It managed to guess that the operating system is Windows.
And sometimes this could be enough for us.
We can see right here it's specified Windows 7,
which is correct,
but it also specified Windows Vista and Windows 2008,
which are incorrect guesses.
Hmm. So we can say that it managed to narrow it down for us,
but it didn't really hit the correct one.
So we checked how to figure out what operating system
is the target running.
We noticed that it doesn't always work,
but this information,
which the information which we will get
in the next video,
will be more than enough for us to be able to
conduct a vulnerability analysis.
Let us see in the next video
how to get exact version of services running on open ports.