312-50 Question 71
Single answer▪ OS Discovery (Banner Grabbing/OSDuring an authorized internal assessment, you need to identify the operating system of a newly deployed server at 10.10.20.15 without logging in to it. A quick TCP connect to port 22 returns the banner "SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5". The client asks whether this banner alone is sufficient to confirm the host OS for reporting. What is the BEST response?
- A
Yes. SSH banners are generated by the kernel, so the banner definitively proves the host is running Ubuntu.
- B
No. The banner is only one clue; it may be customized, proxied, or exposed by a service container, so it should be corroborated with TCP/IP stack fingerprinting and other service evidence before concluding the OS.
- C
Yes. OpenSSH version strings cannot be modified, so the presence of "Ubuntu-4ubuntu0.5" confirms both distribution and patch level of the host OS.
- D
No. Banner grabbing is useless for OS discovery; only authenticated local commands can identify the operating system accurately.
Show answer and explanation
Correct answer: B
Explanation
The best answer is Option 2 because CEH-level OS discovery emphasizes combining multiple reconnaissance methods rather than relying on a single artifact. Banner grabbing can reveal service versions and vendor packaging details, which may suggest an operating system or distribution. However, service banners are application-layer data and can be misleading due to manual customization, NAT/proxy exposure, load balancers, containers, or intentionally deceptive configurations. Best practice is to validate banner findings with active fingerprinting, such as TCP/IP stack analysis. Nmap documentation reflects this distinction: version detection (-sV) identifies services and banners, while OS detection (-O) attempts to infer the operating system using network fingerprinting. In a professional report, the tester should state that the SSH banner suggests Ubuntu but that the OS should be confirmed through corroborating indicators before making a definitive claim.
- A. Incorrect.
Incorrect. SSH banners are produced by the SSH service, not by the kernel itself. While the string strongly suggests an Ubuntu-packaged OpenSSH build, it does not definitively prove the underlying host OS. Administrators can alter banners, reverse proxies may relay them, and services can run inside containers or compatibility layers that do not fully represent the base operating system.
- B. Correct.
Correct. This is the most defensible professional answer. Banner grabbing is a useful source of OS clues, but it is not conclusive on its own. In practice, a tester should correlate the banner with additional evidence such as active OS fingerprinting from TCP/IP stack behavior, TTL/window-size patterns, and other service/version data. This avoids overclaiming in the final report.
- C. Incorrect.
Incorrect. OpenSSH version strings are not immutable proof of the host OS. Banners can be changed, hidden, or forwarded, and package naming conventions can appear in environments that do not exactly match the underlying system being assessed. Assuming exact OS and patch level from a single banner is a common mistake.
- D. Incorrect.
Incorrect. Banner grabbing is not useless; it is a standard reconnaissance technique and often provides valuable hints about services and possible operating systems. However, its limitation is that it should be treated as indicative rather than definitive unless corroborated by other evidence.