Hack Like a Pro: How to Conduct Passive OS Fingerprinting with p0f « Null Byte :: WonderHowTo

Welcome back, my novice hackers!I have tried to emphasize throughout this "Hack Like a Pro" series thatgood reconnaissance is criticalto effective hacking. As you have seen in many of these hacks, the techniques that we use are VERY specific to the:Operating system,Service pack,Installed applications,Open ports,Running services, andEven language.I have shown you how to use a few of the best reconnaissance tools,hping,nmap, andxprobe, but each of these has a weakness—they are active. In other words, you have to send packets at the potential victim to get a read on their attributes. This, of course, risks detection and whenever you send packets to a target, your IP address is attached (unless you spoof your IP address, but then you wouldn't get a response from the target).Using p0f for Passive ReconIn the interest of remaining as stealthy as possible, you want to be able to determine the operating system of a potential target without touching it. That's the beauty ofp0f, which uses attributes of the packets on the wire to determine the operating system that sent the packet.As you probably know, each operating system implements the TCP/IP stack in slightly different ways, and as a result, the TCP packets sent via that OS have slightly different attributes. If we can grab a packet off the wire, examine it, and look for these attributes, we can compare them to a database of attributes and determine with a relatively high degree of accuracy what operating system sent the packet.It's important note, though, that the reliability of passive recon is lower than active recon.Taking a Look at Our TCP/IP PacketThe image below is of a TCP/IP header. The IP header is shaded in yellow and the TCP header is in white. I have circled four fields of that header that are critical in determining the operating system that generated the packet.First: Type of Service (TOS)Their are four different values here.Minimize DelayMaximize ThroughputMaximize ReliabilityMinimize Monetary CostSecond: Flags (DF) of the IP HeaderDon't confuse this with the SYN, FIN,RST, ACK, URG, and PSH flags in theTCPheader. This is the Fragment or Don't fragment flag. This flag is meant to indicate to the receiving system whether the packet has been fragmented.Third: The Time to Live (TTL)This indicates the default setting for the TTL of the packet. Each operating system sets the TTL to maximum number of hops that packet can traverse before it times out. Generally, Windows systems have this set at 32 while Linux systems have the TTL set to 64.Fourth: The Windows FieldThis is probably most important. The Window field sets the size of the buffer of the sending system. This is the way that TCP maintains flow control. This field alone varies the most among operating systems. If you can find this value, you have about 70-80% chance of determining the operating system that sent the packet.Now that have an idea of how p0f works, let's put it to work.Step 1: Open p0fLet's start by firing up BackTrack and then opening p0f. We can do that by going toBackTrack->Information Gathering->Network Analysis->OS Fingerprinting, and finally,p0f.Image viawonderhowto.comWhen we do so, p0f will open a terminal with a help screen like that below.Step 2: Start p0fThere is a lot of information in that help screen, much of which we can leave for another tutorial. To get p0f running, we simply need to type the command (p0f) then-i(for interface), the name of the interface we want to listen on (eth0here) and then the-vand-toptions.bt > p0f -i eth0 -vtWhen we do so, p0f will begin to listen on that interface (as shown above) for any traffic.Step 3: Send TrafficNow, let's send some traffic from a Windows XP system. I simply usednetcatto connect to port 80 on our BackTrack system.As you can see above, p0f identified it accurately as Windows XP SP1. Also note that it identified the type of connection I was using, in this case "ethernet/modem".Step 4: Send Windows 7 TrafficNow, let's send some Windows 7 traffic. Once again, I simply used netcat to connect to port 80. This time, p0f is baffled. It gives us the signature of the packet, but then identifies it as Windows, but doesn't know what version.It was able to identify the connection from an ethernet/modem connection.The problem with the Windows 7 identification, and for that matter anything beyond Windows Vista, is that the developer of p0f stopped updating the signatures in 2006. Any new signatures for new operating systems aren't included in this p0f 1.8 on BackTrack.Step 5: View OS SignaturesP0f stores the operating system signatures in a file at/etc/p0f/p0f.fp. Let's take a look at that file.more /etc/p0f/p0f.fpThis file has a lot of information on p0f, but also includes the operating system signatures. If you scroll down through this file about 60% of the way, you will come to the individual signatures of each operating system.In the screenshot above, you can see the Windows operating systems signatures. You could simply add the signature from your Windows 7 operating system to this file and it would then recognize it the next time a Windows 7 system packet was seen on the wire by p0f.Good News!The good news is that the developer of p0f,Michael Zalewski, has recently releasedp0f version 3that has up-to-date signatures and new features!Now that you understand how p0f works, we will download, extract, and compile the new version of p0f in a future tutorial, so keep coming back my novice hacker!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseFingerprint scanimage via ShutterstockRelatedHack Like a Pro:How to Use the New p0f 3.0 for OS Fingerprinting & ForensicsHack Like a Pro:How to Conduct OS Fingerprinting with Xprobe2How To:Hack Your Firefox User Agent to Spoof Your OS and BrowserNews:How to Study for the White Hat Hacker Associate Certification (CWA)How To:Fingerprint-Lock Apps on Android Without a Fingerprint ScannerHack Like a Pro:How to Conduct Passive Reconnaissance of a Potential TargetHow To:Use BeEF and JavaScript for ReconnaissanceHow To:Use Your Fingerprint Scanner to Do Almost Anything with TaskerHow To:Lock Any App with a Fingerprint on Android MarshmallowHow To:Lock Apps Using Your Samsung Galaxy S6’s Fingerprint ScannerNews:Latest Huawei Mate 20 Rumors & Leaks — Face ID, Massive Battery & Wireless ChargingHow To:Obscure your OS fingerprintHow To:Unlock Your Mac Using Your iPhone's Touch ID or Lock Screen PasscodeAndroid Basics:How to Unlock Your Phone with Your FingerprintHow To:Get the Pixel's Fingerprint Swipe Notification Gesture on Other DevicesNews:10 Great 99 Cent Apps You Need on Your Android Right NowNews:Researchers Find 'MasterPrints' That Can Bypass Your Phone's Fingerprint ScannerNews:OnePlus 5 Looks to Have a Rear Fingerprint SensorHow To:Turn Off Your Android's Screen with Your Fingerprint ScannerHow To:This Hack Lets You Touch Your Galaxy's Home Key Instead of Pressing ItHow To:Make the Fingerprint Scanner Work Faster on Your Galaxy DeviceHow To:Secure Any Android App with Your FingerprintNews:New Biometrics Update Makes the Galaxy S10's Fingerprint Scanner 4 Times FasterHow To:Use All 10 Fingerprints for Touch ID on Your iPhone — Not Just 5 of ThemHow To:Use Your Phone's Fingerprint Scanner to Unlock Your Windows PCNews:Google Pixel's Pros & ConsNews:You Can Get a OnePlus 7 Pro with INSANE Specs for the Price of theXRor S10eHack Like a Pro:The Hacker MethodologyHow To:Unlock Your Fingerprint-Protected Galaxy S5 Using Only One HandHack Like a Pro:How to Fingerprint Web Servers Using HttprintHack Like a Pro:How to Conduct Active Reconnaissance and DOS Attacks with NmapHow To:Earn the 'Passive Aggressive' Achievement in RageNews:What Hand Do I Read, And Why ?News:Fingerprint LibraryVaccine bombshell:Baby monkeys develop autism after routine CDC vaccinationsNews:Hack Your Computer's BIOS to Unlock Hidden Settings, Overclocking & MoreNews:New Apps Let You Sign into Bank of America, Chase, & State Farm with Your FingerprintNews:Obama and Congress Approve Resolution that Supports UN Internet TakeoverNews:Unknown, but They Shouldn't Be.News:Fantasia 2000 (2000)