инструмент исследования сети и сканер безопасности / портов (Network exploration tool and security / port scanner)
OS DETECTION
One of Nmap's best-known features is remote OS detection using
TCP/IP stack fingerprinting. Nmap sends a series of TCP and UDP
packets to the remote host and examines practically every bit in
the responses. After performing dozens of tests such as TCP ISN
sampling, TCP options support and ordering, IP ID sampling, and
the initial window size check, Nmap compares the results to its
nmap-os-db database of more than 2,600 known OS fingerprints and
prints out the OS details if there is a match. Each fingerprint
includes a freeform textual description of the OS, and a
classification which provides the vendor name (e.g. Sun),
underlying OS (e.g. Solaris), OS generation (e.g. 10), and device
type (general purpose, router, switch, game console, etc). Most
fingerprints also have a Common Platform Enumeration (CPE)
representation, like cpe:/o:linux:linux_kernel:2.6.
If Nmap is unable to guess the OS of a machine, and conditions
are good (e.g. at least one open port and one closed port were
found), Nmap will provide a URL you can use to submit the
fingerprint if you know (for sure) the OS running on the machine.
By doing this you contribute to the pool of operating systems
known to Nmap and thus it will be more accurate for everyone.
OS detection enables some other tests which make use of
information that is gathered during the process anyway. One of
these is TCP Sequence Predictability Classification. This
measures approximately how hard it is to establish a forged TCP
connection against the remote host. It is useful for exploiting
source-IP based trust relationships (rlogin, firewall filters,
etc) or for hiding the source of an attack. This sort of spoofing
is rarely performed any more, but many machines are still
vulnerable to it. The actual difficulty number is based on
statistical sampling and may fluctuate. It is generally better to
use the English classification such as 'worthy challenge' or
'trivial joke'. This is only reported in normal output in verbose
(-v) mode. When verbose mode is enabled along with -O, IP ID
sequence generation is also reported. Most machines are in the
'incremental' class, which means that they increment the ID field
in the IP header for each packet they send. This makes them
vulnerable to several advanced information gathering and spoofing
attacks.
Another bit of extra information enabled by OS detection is a
guess at a target's uptime. This uses the TCP timestamp option
(RFC 1323
A paper documenting the workings, usage, and customization of OS
detection is available at https://nmap.org/book/osdetect.html
OS detection is enabled and controlled with the following
options:
-O (Enable OS detection)
Enables OS detection, as discussed above. Alternatively, you
can use -A to enable OS detection along with other things.
--osscan-limit (Limit OS detection to promising targets)
OS detection is far more effective if at least one open and
one closed TCP port are found. Set this option and Nmap will
not even try OS detection against hosts that do not meet this
criteria. This can save substantial time, particularly on -Pn
scans against many hosts. It only matters when OS detection
is requested with -O or -A.
--osscan-guess; --fuzzy (Guess OS detection results)
When Nmap is unable to detect a perfect OS match, it
sometimes offers up near-matches as possibilities. The match
has to be very close for Nmap to do this by default. Either
of these (equivalent) options make Nmap guess more
aggressively. Nmap will still tell you when an imperfect
match is printed and display its confidence level
(percentage) for each guess.
--max-os-tries (Set the maximum number of OS detection tries
against a target)
When Nmap performs OS detection against a target and fails to
find a perfect match, it usually repeats the attempt. By
default, Nmap tries five times if conditions are favorable
for OS fingerprint submission, and twice when conditions
aren't so good. Specifying a lower --max-os-tries value (such
as 1) speeds Nmap up, though you miss out on retries which
could potentially identify the OS. Alternatively, a high
value may be set to allow even more retries when conditions
are favorable. This is rarely done, except to generate better
fingerprints for submission and integration into the Nmap OS
database.
