Ethical Hacking – Fingerprinting



The term OS fingerprinting in Ethical Hacking refers to any method used to determine what operating system is processing on a remote computer. This could be:

  • Active Fingerprinting – Active fingerprinting is accomplished by sending specially made packets to a target machine and then noting down its response and analyzing the gathered information to determine the target OS. In the following section, we are given some examples to explain how we can use NMAP tool to detect the OS of a target domain.

  • Passive Fingerprinting – Passive fingerprinting is based on sniffer traces from the remote system. Based on the sniffer traces ( such as Wireshark ) of the packets, we can determine the operating system of the remote host.

We have the following four important elements that we will look at to determine the operating system –

  • TTL – What the operating system sets the Time-To-Live on the outbound packet.

  • Window Size – What the operating system sets the Window Size at.

  • DF – Does the operating system set the Don’t Fragment bit.

  • TOS – Does the operating system set the Type of Service, and if so, at what.

By analysis these factors of a packet, we may be able to determine the remote operating system. This system is not 100% accurate, and works better for some operating systems than others.

Basic Steps

Before attacking a system, it is required that we know what operating system is hosting a website. Once a target OS is known, then it becomes easy to determine which vulnerabilities might be present to exploit the target system.

Quick Fix

We can hide our main system behind a secure proxy server or a VPN so that our complete identity is safe and ultimately our main system remains safe.

Port Scanning

Once a hacker knows about open ports, then he/she can plan different attack techniques through the open ports.

Quick Fix

It is always recommended to check and close all the unwanted ports to safeguard the system from malicious attacks.

Ping Sweep

A ping seep is a network scanning technique that we can use to determine which IP address from a range of IP addresses map to live hosts. Ping Sweep is also known as ICMP sweep.

You cab use fping command for ping sweep. This command is a ping-like program which uses the Internet Control Message Protocol( ICMP ) ECHO request to determine if a host is up.

Fping is different from ping, in that we can specify any number of hosts on the command line, or specify a file containing the lists of hosts to ping. If a host does not respond within a certain time limit and/or retry limit, it will be considered unreachable.

Quick Fix

To disable ping sweeps on a network, we need to block ICMP ECHO requests from outside sources. This can be done using the following command which will create a firewall rule in iptable.

$iptables -A OUTPUT -p icmp –icmp-type echo-request-j DROP

DNS Enumeration

Domain Name Server( DNS ) is like a map or an address book. In fact, it is like a distributed database which is used to translate an IP address to a name and vice versa.

DNA enumeration is the process of locating all the DNS servers and their corresponding records for an organization. The idea is to gather as much interesting details as possible about our target before initiating an attack.

We can use nslookup command available on Linux to get DNS and host-related information. In addition, we can use the following DNSenum script to get detailed information operations –

  • Get the host’s addresses

  • Get the nameservers

  • Get the MX record

  • Perform axfr queries on nameservers

  • Get extra names and subdomains via Google scraping

  • Brute force subdomains from file can also perform recursion on subdomain that has NS records

  • Calculate C class domain network ranges and perform whois queries on them

  • Perform reverse lookup on net ranges

Quick Fix

Preventing DNS Enumeration is a big challenge. If our DNS is not configured in a secure way, it is possible that lots of sensitive information about the network and organization can go outside and an untrusted internet user can perform a DNS zone transfer.