OS Fingerprinting

Active — Nmap

nmap -O TARGET
nmap -O --osscan-guess TARGET
nmap -A TARGET                       # OS + version + scripts

ping -c 1 TARGET | grep ttl

TTL 64 → likely Linux. TTL 128 → likely Windows.

p0f -i eth0
p0f -i eth0 -o output.txt
p0f -r capture.pcap

Identifies OS from TCP SYN packets without sending traffic.

nc -nv TARGET 22
nmap -sV -p 22 TARGET
curl -I http://TARGET

telnet TARGET 80
HEAD / HTTP/1.1
Host: TARGET

nmap --script=smb-os-discovery TARGET
nmap -p 445 --script=smb-os-discovery TARGET

Method	Command
Active OS	`nmap -O TARGET`
TTL check	`ping -c 1 TARGET`
Passive	`p0f -i eth0`
Banner grab	`nc -nv TARGET PORT`
SMB OS	`nmap --script=smb-os-discovery TARGET`