Kali Linux 2018: Assuring Security by Penetration Testing

The p0f tool is used to fingerprint an operating system passively. It can be used to identify an operating system on the following machines:

Machines that connect to your box (SYN mode; this is the default mode)
Machines you connect to (SYN + ACK mode)
Machines you cannot connect to (RST+ mode)
Machines whose communications you can observe

The p0f tool works by analyzing the TCP packets sent during the network activities. Then, it gathers the statistics of special packets that are not standardized by default by any corporations. An example is that the Linux kernel uses a 64-byte ping datagram, whereas the Windows operating system uses a 32-byte ping datagram or the Time To Live (TTL) value. For Windows, the TTL value is 128, while for Linux this TTL value varies among Linux distributions. This information is then used by p0f to determine the remote machine's operating system.

When using the p0f tool included with Kali Linux, we were not able to fingerprint the operating system on a remote machine. We figured out that the p0f tool hadn't updated its fingerprint database. Unfortunately, we couldn't find the latest version of the fingerprint database. So, we used p0f v3 (version 3.06b) instead. To use this version of p0f, just download the TARBALL file from http://lcamtuf.coredump.cx/p0f3/releases/p0f-3.06b.tgz and compile the code by running the build.sh script. By default, the fingerprint database file's (p0f.fp) location is in the current directory. If you want to change the location, for example, to /etc/p0f/p0f.fp, you need to change this in the config.h file and recompile p0f. If you don't change the location, you may need to use the -f option to define the fingerprint database file location.

To access p0f, open a console and type p0f -h. This will display its usage and options description. Let's use p0f to identify the operating system used in a remote machine we are connecting to. Just type the following command in your console:

  p0f -f /etc/p0f/p0f.fp -o p0f.log

This will read the fingerprint database from the file and save the log information to the p0f.log file. It will then display the following information:

        --- p0f 3.07b by Michal Zalewski <lcamtuf@coredump.cx> ---
    
    [+] Closed 1 file descriptor.
    [+] Loaded 320 signatures from '/usr/share/p0f/p0f.fp'.
    [+] Intercepting traffic on default interface 'eth0'.
    [+] Default packet filtering configured [+VLAN].
    [+] Log file 'p0f.log' opened for writing.
    [+] Entered main event loop.

Next, you need to generate network activities involving a TCP connection, such as browsing the remote machine or letting the remote machine connect to your machine. For the purposes of this demonstration, a connection to the HTTP site on the 2 machine was established.

If p0f has successfully fingerprinted the operating system, you will see information on the remote machine's operating system in the console and in the log file (p0f.log).

The following is the abridged information displayed to the console:

    .-[ 172.16.43.150/41522 -> 172.16.43.156/80 (syn+ack) ]-
    |
    | server   = 172.16.43.156/80
    | os       = Linux 2.6.x
    | dist     = 0
    | params   = none
    | raw_sig  = 4:64+0:0:1460:mss*4,5:mss,sok,ts,nop,ws:df:0

The following screenshot shows the content of the log file:

Based on the preceding result, we know that the target is a Linux 2.6 machine.

The following screenshot shows the information from the target machine:

By comparing this information, we know that p0f got the OS information correctly. The remote machine is using Linux Version 2.6.

You can stop p0f by pressing the Ctrl + C key combination.

Table of Contents for Kali Linux 2018: Assuring Security by Penetration Testing - Fourth Edition

Table of Contents for
Kali Linux 2018: Assuring Security by Penetration Testing - Fourth Edition