312-50 Question 72
Single answer▪ OS Discovery (Banner Grabbing/OSDuring an authorized internal assessment, you discover a host that responds on TCP 22 and TCP 80, but ICMP echo requests are blocked by the perimeter firewall. The client wants you to identify the likely operating system with the least intrusive method possible before attempting any active fingerprinting. You connect to TCP 22 and receive the banner "SSH-2.0-OpenSSH_8.4p1 Debian-5". An HTTP HEAD request to TCP 80 returns a header containing "Server: Apache/2.4.54 (Debian)". Which conclusion is the MOST appropriate at this stage?
- A
The host is definitely running Debian Linux, because service banners provide conclusive OS identification.
- B
The host is likely a Debian-based Linux system, but the result should be treated as indicative because banners can be customized, proxied, or intentionally misleading.
- C
The host is running Windows Server, because OpenSSH and Apache are commonly installed on Windows environments.
- D
No OS inference can be made from banners; only TCP/IP stack fingerprinting can identify the operating system.
Show answer and explanation
Correct answer: B
Explanation
Banner grabbing is a practical, low-impact OS discovery method that relies on information voluntarily disclosed by services such as SSH, HTTP, SMTP, and FTP. In this scenario, two different services independently reference Debian, which strengthens the inference. However, CEH candidates should recognize that banners are not authoritative because they may be altered, suppressed, relayed through reverse proxies, or exposed from applications running in containers rather than the base OS. The best practice is to correlate passive and low-impact findings first, then validate with additional techniques only if required and within scope. This aligns with common guidance in tools and documentation such as OpenSSH version-string behavior, Apache Server header behavior, and Nmap service/version detection principles, all of which emphasize that service-reported data is valuable but not guaranteed to be exact proof of the underlying operating system.
- A. Incorrect.
This is incorrect because banners are useful for OS discovery, but they are not conclusive proof. SSH and HTTP server banners can reveal platform hints such as Debian, yet administrators can modify banners, reverse proxies can insert their own headers, and services may run in containers or on non-native platforms. Treating banners as definitive is a common mistake in reconnaissance.
- B. Correct.
This is correct. Both the SSH banner and HTTP Server header suggest Debian, so the most reasonable conclusion is that the host is likely Debian-based or at least running Debian-packaged services. However, banner grabbing is an indirect OS discovery technique and should be considered indicative rather than absolute. This matches best practice in enumeration: correlate multiple sources and avoid overconfidence when relying on self-reported service information.
- C. Incorrect.
This is incorrect. While OpenSSH and Apache can run on Windows, the specific banners shown explicitly reference Debian. Choosing Windows here ignores the strongest available evidence and reflects a misconception that service availability alone outweighs direct banner indicators.
- D. Incorrect.
This is incorrect because banner grabbing can absolutely support OS discovery, especially when services self-identify platform or distribution details. TCP/IP stack fingerprinting is another valid method, but it is not the only way to infer an OS. In this scenario, the least intrusive approach is to use the information already disclosed by the services.