B8 - OS Fingerprinting

Question 1

What is OS fingerprinting?

Answer 1

Process of analysing data packets which originate from a network to collect intelligence to be used in later attacks

Question 2

What is active OS fingerprinting?

Answer 2

Actively probing a target system with specially crafted packets and analysing the TCP/IP behaviour of the received responses. - More accurate, more invasive.

Question 3

What is passive OS fingerprinting?

Answer 3

Examining passively collected sample of packets from a host - Less accurate, but more effective in avoiding detection.

Question 4

Common ports involved in OS fingerprinting:

Answer 4

TCP Port 80 (HTTP), TCP/UDP Port 53 (DNS), TCP Port 443 (HTTPS), TCP/UDP 135 (MSRPC), TCP Port 22 (SSH), TCP Port 445 (SMB).

Question 5

Which nmap flag enables Operating System TCP/IP stack fingerprinting?

Answer 5

-O

Question 6

Commonly used tools for Active OS Fingerprinting:

Answer 6

nmap, Xprobe2, SinFP

Question 7

Commonly used tools for Passive OS Fingerprinting:

Answer 7

p0f, Wireshark, Ring