OS FINGERPRINTING & CONCEALING YOUR IDENTITY

 

OS FINGERPRINTING

OS fingerprinting is the process of detecting the operating system of the target host or a
network. The following are some of the commonly used OS fingerprinting methods.

Active Fingerprinting

Active fingerprinting is the method in which specially crafted packets are sent to the
target system and the response is noted. Since different operating systems respond to
source packets in different ways, this response can be analyzed to determine the target OS.
One of the simple example is the use of Nmap tool as discussed in the previous section
which employs active fingerprinting method to determine the target OS.

Banner Grabbing

Another commonly used method of active fingerprinting is called banner grabbing. This
can be done using a simple tool called telnet. Telnet is readily available on Windows XP
and previous versions. For Windows Vista, 7 and 8 machines you need to activate the inbuilt telnet tool before you can use it. Just search for “how to enable telnet on windows”
on Google to find detailed instructions for enabling telnet client on your computer.
Once you have enabled the telnet client on your computer, banner grabbing is pretty
simple. Just type the following command in the command prompt to detect the operating
system running on the target:

telnet target-domain-or-IP 80

This will open the connection with the target. Next type the text exactly as follows HEAD
/ HTTP/1.1 and hit the Enter key twice. This should fetch results where there is a
possibility of the target OS


Passive Fingerprinting

Passive fingerprinting is a technique that uses indirect methods to determine the target
operating system. Unlike active fingerprinting which sends packets to the target, passive
fingerprinting on the other hand uses sniffing technique to analyze the target network
traffic and determine the operating system. It is less accurate than active fingerprinting.

You can use online tools like Netcraft to perform passive fingerprinting.

Netcraft Tool: http://toolbar.netcraft.com/site_report

Just visit the above link to access the Netcraft tool and enter the target domain or IP
address to know the target operating system, possible vulnerabilities, its risk rating and
other useful information.

CONCEALING YOUR IDENTITY

Concealing you true identity during the processes like footprinting and scanning is very
much necessary as there is a real chance of the target tracing back to you. Some of the
methods that you can employ to conceal your identity are discussed below.

Using a Proxy

A proxy server can be used to conceal your real IP address while performing scanning and
hack attempts on the target. Since the IP address tells everything about you, concealing it
using a proxy can be highly effective in hiding your origin.

Even though there are different types of proxies available, I recommend using a VPN
proxy service to hide your IP address. VPN services are fast and provide reliable ways not
only to hide your IP address but also to protect your data and identity over the Internet.

Here are a few popular VPN services that you can try:

HideMyAss Proxy

VyprVPN Proxy

Alternatively you can also use a chain of public proxies to further enhance your stealth
operation using free tools like Proxifier and SocksChain. Please note that using public
proxies can slow down your speed and hence VPN proxies are more recommended as they
best serve the purpose.

The other way to hide your identity is by using online tools for pinging and scanning the
target. During the use of online tools, the IP address of the server hosting the tools is
exposed to the target and not the one that belongs to the actual attacker.

Once you have gathered a long list of information about the target through footprinting
and scanning, it is time to analyze them for possible vulnerabilities in the operating
system, technologies or services running on the target. You can make use of the following
websites to find information about latest vulnerabilities and exploits:

1. http://www.securiteam.com

2. http://www.zone-h.org

3. http://www.securityfocus.com

4. http://www.packetstormsecurity.com