Fingerprinting the operating system of a host

Determining the operating system of a host is essential to every penetration tester for many reasons including listing possible security vulnerabilities, determining the available system calls to set the specific exploit payloads, and for many other OS-dependent tasks. Nmap is known for having the most comprehensive OS fingerprint database and functionality.

This recipe shows how to fingerprint the operating system of a remote host by using Nmap.

How to do it...

Open a terminal and enter the following:

#nmap -O <target>

The output will look similar to the following:

# nmap -O scanme.nmap.org
Nmap scan report for scanme.nmap.org (74.207.244.221)
Host is up (0.12s latency).
Not shown: 995 closed ports

Get Nmap 6: Network Exploration and Security Auditing Cookbook now with the O’Reilly learning platform.

O’Reilly members experience live online training, plus books, videos, and digital content from nearly 200 publishers.