Hack Like a Pro: How to Use the New p0f 3.0 for OS Fingerprinting & Forensics « Null Byte :: WonderHowTo

Welcome back, my fledgling hackers!A short while ago, I did a tutorial onconducting passive OS fingerprinting with p0f. As you remember, p0f is different from other operating system fingerprinting tools as it does not send any packets to the target, instead it simply takes packets off the wire and examines them to determine the operating system that sent them.p0f relies upon the different ways that each OS implements the TCP/IP stack, and these different implementations leave their unique fingerprints on the TCP/IP packets. These differences are found in four key fields of the TCP/IP packet—theDF,TTL,Window, andTOS.In ourprevious p0f tutorial, we had tested p0f against older operating systems and it did its fingerprinting superbly! When we tried it against Windows 7 and other more current systems, we found that the signatures had not been updated since 2006.We could have collected the signatures of different systems and added them to the/etc/p0f/p0f.fpfile to bring the signatures database current, but I mentioned at the time that the developers of p0f had finally updated it and released version 3.0 after lying dormant for over 6 years.In the new version, they have not only updated the signatures, but also added new capability to p0f. The new version has been included in the latest release ofKali(1.0.6), so let's take a look at it here. For those usingBackTrackor early versions of Kali, you can download the new p0fhere.Step 1: Fire Up Kali & Open p0fLet's start by firing up Kali and opening p0f 3.0 up. Interestingly, Kali has placed p0f underForensictools, so to open it, we need to go to Kali Linux -> Forensics -> Network Forensics -> p0f.When we open it, we are greeted with a help screen like that below. The syntax is pretty much the same as the earlier versions; it's simply the command and the interface.kali>p0f -i eth0Step 2: Send Packets from Windows Server 2003Now, like we didwith the older p0f 1.6, let's send packets from a Windows Server 2003 system. We can do that in a number of ways—ftp, telnet,netcat, or simply by opening a browser directed to the IP address of our Kali system.When we do so, we get the results below. p0f identifies the IP address and the link and then identifies the OS as a "Windows NT kernel". Not real specific, but accurate.Step 3: Send Packets from Windows XPLet's now try the same with Windows XP and see what p0f can decipher for us. In this case, I'll try connecting to an ftp server on Kali.Once again, p0f is accurate, but not very specific. It identifies the OS as Windows NT kernel. Remember that p0f is using the differences in the TCP/IP stack implementation as the way of identifying the OS and if a range of operating systems are using the same TCP/IP stack, it cannot differentiate between them.Step 4: Send Packets from Windows 7One of the issues we found with the older p0f is that the signatures were old (no updates after 2006) and it did not have signatures for Windows 7, 8, Server 2008, and Server 2012. Let's test p0f on one of the modern systems, such as Windows 7.As you can see, it accurately identified it as "Windows 7 or 8". As these two systems are from the same build, it can't distinguish the difference between them. As a hacker, in most cases, the differences are unimportant.Step 5: Send Packets from UbuntuNow let's try sending some packets from a Ubuntu machine.As you can see, p0f accurately deciphered that the system sending the packets was a Linux system with 3.x kernel.Step 6: Run p0f for ForensicsIn our final test of the effectiveness of the new p0f, let's just let p0f run on our interface and see what it picks up. This can be useful for doing forensics on a compromised system or a system under attack.When I let p0f run for a short while on my eth0 interface, I soon started to get entries like those above. I found this puzzling. My Kali system was connecting to an unknown IP address at 64.182.234.103.In the screenshot above, it identifies it as a Linux server and 17 hops away. This seems odd for several reasons. First, I have not been connecting to any website or server at that address. In fact, my system has been completely idle. Second, 17 hops is long—way long. Generally, you can connect to nearly any server on the planet within 15 hops. This is something I should investigate!As I scroll down the p0f entries, I can get more information on this server that my Kali system connected to. I can see that my system connected from my port 37416 to its port 80 and that this server has been up over 31 straight days.Further investigation reveals that this IP address belongs toowncloud.org. I never went to this address, but apparently the folks at Offensive Security have put a client in Kali that is connecting to this site automatically. From the documentation on the website, I was able to decipher that it's apparently a free cloud service similar to Google Apps.I'm not happy about this! There is nothing that I can find in the Kali documentation regarding this. I'm not saying that this is anything malicious, but I think the folks at Offensive Security should have told us explicitly that they have included a client that automatically connects to this cloud service.The new p0f is an improvement over the older version, but still is not perfect. Passive reconnaissance has the advantage of being undetectable, but the disadvantage of lower reliability of results. A tool like p0f, though, can be invaluable in identifying the operating systems of the clients that are accessing your website or the systems passing your wire while sniffing traffic.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseOriginal coded fingerprint image viaShutterstock, remixed by Justin Meyers/WonderHowToRelatedHack Like a Pro:How to Conduct Passive OS Fingerprinting with p0fHow To:Become a Computer Forensics Pro with This $29 TrainingHow To:Hack Your Firefox User Agent to Spoof Your OS and BrowserHow To:Obscure your OS fingerprintHack Like a Pro:How to Conduct OS Fingerprinting with Xprobe2Apple vs. Samsung:The Battle of the Big Phones — Galaxy Note 10+ vs. iPhone 11 Pro MaxNews:Latest Huawei Mate 20 Rumors & Leaks — Face ID, Massive Battery & Wireless ChargingHow To:Fingerprint-Lock Apps on Android Without a Fingerprint ScannerHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 6 (Using IDA Pro)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)How To:Lock Any App with a Fingerprint on Android MarshmallowHow To:Use BeEF and JavaScript for ReconnaissanceHow To:Get the Pixel's Fingerprint Swipe Notification Gesture on Other DevicesHack Like a Pro:Digital Forensics Using Kali, Part 1 (The Tools of a Forensic Investigator)News:Why YOU Should Study Digital ForensicsHow To:Use Your Fingerprint Scanner to Do Almost Anything with TaskerHow To:Lock Apps Using Your Samsung Galaxy S6’s Fingerprint ScannerNews:Researchers Find 'MasterPrints' That Can Bypass Your Phone's Fingerprint ScannerHow To:Cut, copy, and paste on your iPhoneNews:New Biometrics Update Makes the Galaxy S10's Fingerprint Scanner 4 Times FasterHow To:Turn Off Your Android's Screen with Your Fingerprint ScannerHow To:This Hack Lets You Touch Your Galaxy's Home Key Instead of Pressing ItNews:OnePlus 5 Looks to Have a Rear Fingerprint SensorHow To:Unlock Your Mac Using Your iPhone's Touch ID or Lock Screen PasscodeHow To:Use All 10 Fingerprints for Touch ID on Your iPhone — Not Just 5 of ThemAndroid Basics:How to Unlock Your Phone with Your FingerprintHow To:Make the Fingerprint Scanner Work Faster on Your Galaxy DeviceHow To:Use Your Phone's Fingerprint Scanner to Unlock Your Windows PCNews:Google Pixel's Pros & ConsNews:10 Great 99 Cent Apps You Need on Your Android Right NowHow To:Secure Any Android App with Your FingerprintNews:Everything You Need to Know About the OnePlus 7 ProHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 5 (Windows Registry Forensics)How To:Make a Windows-to-Go Ready USB Drive in Windows 8Gadget Hacks' Wish List:Features We Want in Android NHow To:Don't Get Caught! How to Protect Your Hard Drives from Data ForensicsNews:Fingerprint LibraryNews:Hack Your Computer's BIOS to Unlock Hidden Settings, Overclocking & MoreHow To:The Official Google+ Insider's Guide IndexNews:New Apps Let You Sign into Bank of America, Chase, & State Farm with Your Fingerprint