Chapter 14 remote identification of the operating system
the unauthorized reproduction in whole or in part of this publication in any form is prohibited.
This lesson describes the ways to remotely identify the operation system version.
We will begin the demonstration with the simplest solutions
using the telnet program.
It is possible to check the version of the service working on the server.
The first parameter is the hostname.
The second is the port.
We will not always manage to guess what version of the remote operating system with this method.
In this case it is necessary to use additional tools.
Let's copy them.
After equipping ourselves with the right tools it is time to unpack them compile them and install in
the system.
The compiling process can take some time depending on the hardware resources available to us.
Let's focus on the compilation and installation of the popular map scanner
after the installation of map.
It's time for the ex-pro to application the set of installation commands is identical
Finally we compile the program
having a complete environment we can start the test using the end map program.
We perform an example of scanning
using the minus 0 option.
We can obtain the version of the operating system
as we can see in the answer we can see discrepancies in regard to the real version.
The application to determine the system version performs a series of tests which compares with the signatures
it possesses.
Let's take a closer look at them.
As we can see the signature in the example on the first glance seems slightly eligible.
The reader can find detailed descriptions on each field of the signature database in the handbook.
Let's now test the function of the next program X probe to
as we can see the standard setup of the program didn't return 100 percent of the information
we can improve the results slightly by defying the open and closed ports of the server under investigation.
This time the basic result is close to perfect.
We obtained 97 percent probability each of the programs presented so far belongs to the active scanners.
This means that to obtain the result it generates the data itself.
Next we will have a closer look at the POS program in contrast to the previous programs.
It is a passive scanner
for the program to bring results on the network an exchange of packet's has to take place.
In our case it will generate traffic on an additional con.
as we can see the attempt to analyze the Y in packets didn't produce any results.
Let's try to use the A C K and R S T packets for our test.
Finally scanning with the use of the r s t packets only brought near perfect results.
All the program signatures are located in the files PLF FP POS A.
F p p f o f p and p f r FP.
Let's take a look at one of them.
As we can see the program database also contains records regarding and map.
In this way it is possible to intercept the scanning which we can demonstrate immediately.
The PLF application is a universal tool.
It can help us to identify the version of the operating system as well as to intercept a potential attack.