Welcome to the unmap lesson on
operating system detection and
fingerprinting of detection
and fingerprinting is one of the
most powerful features of MAP.
And just like application and
service version detection, there's
a lot to cover in this lesson.
So let's get right to it.
Here are the learning objectives for
this lesson.
First, we'll talk about what
operating system detection and
fingerprinting is and then map.
Second, we'll discuss why it is both
relevant and important.
Third, we'll talk about when and how
to use it, including the most
important command line option.
You need to know that I'll
provide a couple other command
line options that are really
helpful.
And we'll finish up this lesson with
the lab on operating system
detection and fingerprinting.
Let's get started.
OS detection is exactly as it
sounds, and MAP sends
up to 16 DCPI
UDP and ICMP probes
against the target then evaluates
responses in order to determine the
operating system that the target is
running.
There are several ways to perform OS
detection and map, which will go
over later, but fundamentally
it can be performed with a single
command line switch and that is dash
capital o.
The combination of all responses
received by and make up the devices
fingerprint.
So OS detection tells
us what operating system the target
is running.
But fingerprinting provides us with
details about that system that make
up a more unique ID
in general. OS detection and
fingerprinting is much more accurate
and informative on a local network
than on a remote network, but
it provides extremely valuable
information in both cases.
The last bullet point is a reference
to a great entry point into
discovering all of end maps
capabilities regarding OS detection
and fingerprinting.
Oh, its detection and fingerprinting
offers many of the same benefits as
application and service version
detection and provides answers
to key questions that interest both
network admins and information
security professionals.
It's include asset management,
licensing and compliance, among
others, for network admins
and security operations teams.
It is vital to know what
operating systems are running on
your network and map can
either be your primary source for
learning this information quickly,
or it can be a secondary source to
compare against your asset
management software.
One obvious benefit to having
multiple sources of this information
is that any differences in the
two may indicate unknown or
rogue devices.
In this case, as detection and
fingerprinting and unmap may
lead to further investigation of
a potential breach
for penetration testers.
Learning the operating system of
your target is just as important as
learning app and service versions.
The vulnerabilities that exist in
older and unpatched operating
systems provide low hanging fruit
for exploitation.
Once a machine on the inside of the
network perimeter has been breached,
pivoting to other machines is much
easier.
So OS detection is a great
way to quickly find target machines.
So far, we've discussed a lot about
how and map discovers devices on a
network, then scans for open ports,
then attempts to determine what
services and application versions
are running on target posts.
In the last lesson, I suggested that
this is the normal flow of map
scanning, and I truly believe that
is a great way to structure your
approach to scanning.
I've placed OS detection and
fingerprinting on the end of this
module for one reason alone,
and that is because of the
complexity of what and MAP is
performing during an OS detection
scan.
With that said, I'd suggest
one possible alteration to your
scanning of a network.
Consider performing device discovery
first, then OS detection
and fingerprinting followed by port
scanning and serve as an application
version detection.
I've placed a graphic at the top of
this slide to represent the flow.
Obviously how you structure your
scanning is completely up to you,
and depending on your objective,
this flow may not always be
appropriate for your
use of time.
But I think you'll agree that this
flow makes sense because your scan
results in each phase will
become more and more granular,
and the end result will be an
extreme amount of detail of your
Target network and its hosts.
The basic command for performing OS
detection and fingerprinting is
simple.
It is and map space dash
capital o.
In my experience, and especially on
a network with a lot of Windows
hosts, an enhancement to this
scan is and map space
dash capital o space
dash dash script equals smb
dash os dash discovery
space dash v then
the target host.
We've discovered we've covered Nesse
in several past lessons and
we'll go over it. More detail the
next one, but the use
of SMB Dash OS Dash
Discovery script will be
very helpful and informative when
performing OS detection, so I
simply couldn't justify leaving it
out of this lesson.
I'll demonstrate it in the lab.
Additionally, I suggest that you use
the Dash V to increase the
verbosity of your scan results.
Not only will you get instant
gratification of each scanning
phase, but will also get some detail
that you wouldn't normally obtain.
The last bullet point on this slide
simply shows you the command as it
is typed out in its entirety against
the host when I need to dot 168,
dot 110.
Here are some other command line
options that you can add to your OS
detection scan along with the dash
capital o.
With the exception of the last one,
which is Dash Capital A,
I've shown you Dash Capital A
in the past and I've told you how
powerful it is.
The difference between the first
three options and the dash capital A
is that the first three will
complement Dash Capital O,
whereas the Dash Capital A
can be used as a replacement for
dash capital o
dash os scandal limit
is said to limit OS detection
to promising targets.
In other words, if you're trying to
perform OS detection against an
entire subnet and want it to be
accurate, get go quickly.
Add the dash dash os scan
dash limit option.
As you'll see when you run OS
detection scans and MAP will tell
you that OS detection
is most effective if at least
one open and one closed TCP
ports are found.
Dash dash os scan dash limit
causes the dash o
dash capital o or dash capital
A to only be performed
when these conditions are met.
Dash dash os scan dash guess
or dash fuzzy for short
are the same thing and we'll guess
os detection results
when you run a normal dash capital
o and map will only
provide you with a guess of the
target OS if is very confident
in its results
when you use this option and
map will give you its best guess and
we'll add a confidence level for
each guest.
Again, you'll see this in the lab.
Dash dash max dash os
dash treis followed
by a space and a number will set
the maximum number of OS detection
charges against the target
when and map dash capital O
or dash capital A is performed
and fails to find a perfect match.
It will repeat the attempt five
times until it provides you with the
result.
The dash dash max OS tries
allows you to fine tune and map
in such a way that you can
essentially increase the speed or
increase the possibility of accuracy
of the OS detection scan.
Finally, dash capital A.
I consider placing Dash
A in the lesson on service and
version detection, but decided not
to is simply to reduce redundancy
and save time.
Dash Capital A stands for advanced
and aggressive.
Well, at least that's why I decided
the creators of N haven't decided
what which it stands for, so
I decided to make it stand for both.
If you walk away from this course
remembering little about the command
line switches I provided.
I urge you to remember Dash Capital
A.
It is somewhat slow and noisy, but
it provides a lot of bang for the
buck.
Essentially, it performs detailed
port scanning, OS detection
and application inversion detection
All-In-One.
Additionally, it runs NASA
script scans against the target
hosts.
I think that the map creators
decided not to make it stand for
aggressive because of their timing
option.
Dash Capital T for
capital T for adjust the
timing of an end map scan to
aggressive the dash capital
A does not do that by default.
However, from an idea standpoint,
all of the things that the dash
capital option performs will
certainly look aggressive and even
somewhat hostile.
So use it carefully.
In some cases, it may even appear to
be a denial of service attack.
Now into the lab in this lab
will run through the steps mentioned
in an earlier slide.
First, we'll do a host discovery
scan, then we'll do simple
OS detection and fingerprinting
scan.
Then we'll add some additional
options and finally will perform
an advanced and aggressive scan
using the dash capital A
let's do it.