Hack Like a Pro: How to Conduct OS Fingerprinting with Xprobe2 « Null Byte :: WonderHowTo

Welcome back, my novice hackers!I've written a couple of articles onreconnaissanceand its importance, and as I've said before, a good hacker will spend 3 to 4 more times doing reconnaissance than actually exploiting the system. If your recon isn't good, you'll likely fail, or worse—end up serving time and becoming Bubba's wife for a couple years. I can't say it enough—recon is critical.Among the information we need to gather are the open ports, running services, and the operating system. Although such tools asnmapandhping2can do operating system fingerprinting, they are not as accurate and reliable as the tools that are built specifically for this purpose.In this tutorial, we'll use one of the bestactivetools for doing OS fingerprinting,xprobe2, which is an active OS fingerprinter, meaning that it actually sends probes to the target system, then gauges the OS from the system's response. In total, xprobe2 has 16 different modules it runs to help determine the OS.It probably goes without saying that any fingerprinter that's probing with special packets is going to be noisy and likely detected byNIDSand other security systems.Step 1: Find xprobe2Like so many other great hacker tools, xprobe2 is included in ourBackTrackdistribution. To find it, type:whereis xprobe2As you can see from the screenshot above, it's in the/usr/local/bin, so if that directory is in our PATH variable, we can use xprobe2 from any directory.Step 2: Find HelpNow, let's get some basic help to run xprobe2 for OS fingerprinting.xprobe2The syntax for running an xprobe2 fingerprint is really straightforward. We simply need the command and the target.xprobe2 <target domain or IP>Step 3: Fingerprint with xprobe2Now, let's point xprobe2 at some systems and see what it's able to tell us. I'll first point it at my Windows 2003 Server VM.As you can see, xprobe2 identified it as Windows XP (100%) and Windows 2003 Standard Edition (100%). As these are the same Windows build, this is not surprising.When I run nmap with OS fingerprinting (nmap -O), I get similar results.Step 4: Fingerprint an Unknown SystemNow, let's try fingerprinting an unknown system. For example, google.com.xprobe2 google.comXprobe2 tells us with 100% probability that the system is Foundry Networks Ironware. This is the gigabit switch on the google.com domain.Xprobe2 then identifies, with lower probability of being correct, the Linux kernel version of the server. This is good example of how imperfect even very good products are and require some knowledge and skill to interpret the results.Step 5: List xprobe2 ModulesAs I mentioned earlier, xprobe2 has 16 modules that it uses to try to determine the operating system of the target. It uses each of them to try to determine the probability of its guess. Let's look at those modules.xprobe2 -LBy default, xprobe2 uses all of its modules, but we can remove modules by using the-Dswitch. For instance, on many networks theicmp moduleswill hang and you may need to remove these modules to get xprobe2 to work. To run xprobe2 without the icmp port unreachable module (#11), we could run xprobe2 like this:xprobe2 -D 11 google.comStep 6: Test Another Public DomainLet's try xprobe2 on another public domain, such as espn.com.xprobe2 espn.comAs we can see, xprobe2 tells us that it has determined with a 92% probability that espn.com is running OpenBSD 3.4. It also shows us that espn.com might be running a different version (3.5-3.7) of OpenBSD, but it's pretty certain it's OpenBSD.Xprobe2, like nmap and hping, is an essential reconnaissance tool that should be in every hacker's toolbox. If you have questions on this or any hacking recon, ask below in the comments.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseFingerprint photovia ShutterstockRelatedHack Like a Pro:How to Hack into Your Suspicious, Creepy Neighbor's Computer & Spy on HimHow To:Hack Your Firefox User Agent to Spoof Your OS and BrowserHow To:Fingerprint-Lock Apps on Android Without a Fingerprint ScannerHack Like a Pro:How to Conduct Passive OS Fingerprinting with p0fHow To:Use Your Fingerprint Scanner to Do Almost Anything with TaskerHow To:Lock Any App with a Fingerprint on Android MarshmallowHow To:Lock Apps Using Your Samsung Galaxy S6’s Fingerprint ScannerNews:Latest Huawei Mate 20 Rumors & Leaks — Face ID, Massive Battery & Wireless ChargingHow To:Obscure your OS fingerprintHow To:Unlock Your Mac Using Your iPhone's Touch ID or Lock Screen PasscodeAndroid Basics:How to Unlock Your Phone with Your FingerprintHow To:Get the Pixel's Fingerprint Swipe Notification Gesture on Other DevicesNews:10 Great 99 Cent Apps You Need on Your Android Right NowHack Like a Pro:How to Use the New p0f 3.0 for OS Fingerprinting & ForensicsNews:Researchers Find 'MasterPrints' That Can Bypass Your Phone's Fingerprint ScannerHow To:Turn Off Your Android's Screen with Your Fingerprint ScannerHow To:This Hack Lets You Touch Your Galaxy's Home Key Instead of Pressing ItHow To:Make the Fingerprint Scanner Work Faster on Your Galaxy DeviceNews:OnePlus 5 Looks to Have a Rear Fingerprint SensorHow To:Secure Any Android App with Your FingerprintNews:New Biometrics Update Makes the Galaxy S10's Fingerprint Scanner 4 Times FasterHow To:Use All 10 Fingerprints for Touch ID on Your iPhone — Not Just 5 of ThemHow To:Use Your Phone's Fingerprint Scanner to Unlock Your Windows PCNews:You Can Get a OnePlus 7 Pro with INSANE Specs for the Price of theXRor S10eHow To:Use BeEF and JavaScript for ReconnaissanceNews:Google Pixel's Pros & ConsHack Like a Pro:How to Fingerprint Web Servers Using HttprintNews:How to Study for the White Hat Hacker Associate Certification (CWA)How To:Unlock Your Fingerprint-Protected Galaxy S5 Using Only One HandHow To:Add Quick App Shortcuts to the in-Display Fingerprint Scanner on Your OnePlusNews:Samsung Scraps In-Display Fingerprint Scanner for Galaxy Note 8News:This Hack Turns Your iPad into a Multi-Window Multitasking Powerhouse for $10Gadget Hacks' Wish List:Features We Want in Android NNews:Fingerprint LibraryVaccine bombshell:Baby monkeys develop autism after routine CDC vaccinationsNews:Hack Your Computer's BIOS to Unlock Hidden Settings, Overclocking & MoreNews:New Apps Let You Sign into Bank of America, Chase, & State Farm with Your FingerprintNews:Obama and Congress Approve Resolution that Supports UN Internet TakeoverNews:Unknown, but They Shouldn't Be.News:Fantasia 2000 (2000)