312-50 Question 73
Single answerFingerprinting)During an authorized external assessment, you identify that a target host allows ICMP echo replies and has TCP ports 80 and 443 open. The client asks you to determine the operating system as accurately as possible without relying on a login banner, because they suspect banners may be customized. Which approach would provide the most reliable OS fingerprinting result in this situation?
- A
Use active TCP/IP stack fingerprinting with a tool such as Nmap OS detection against the host and correlate the results with observed network behavior
- B
Rely on the HTTP Server header from port 80 because web servers typically reveal the underlying operating system accurately
- C
Perform a DNS zone transfer against the target domain to identify the host's operating system from DNS records
- D
Use banner grabbing on port 443 only, because TLS service banners cannot be modified and therefore reliably expose the OS
Show answer and explanation
Correct answer: A
Explanation
For OS fingerprinting, CEH candidates should distinguish between application-layer identification and TCP/IP stack fingerprinting. When banners may be customized, active OS detection is typically the better choice because it evaluates low-level protocol implementation details that are harder to fake consistently. Nmap's OS detection engine is a standard example: it sends multiple probes and compares responses to a signature database to estimate the OS and version. In practice, best results come when the target exposes at least one open and one closed TCP port, though useful results may still be possible with limited exposure. Banner grabbing, HTTP headers, and TLS metadata can support service fingerprinting, but they should not be treated as authoritative for OS identification. This aligns with common penetration testing methodology and Nmap documentation on remote OS detection and TCP/IP stack fingerprinting.
- A. Correct.
Correct. Active TCP/IP stack fingerprinting analyzes characteristics such as TCP window size, TTL behavior, DF bit handling, TCP options, and responses to crafted probes. Tools like Nmap use these traits to compare the target's network stack behavior against known signatures. This is more reliable than banners when the client suspects service banners may be altered or proxied. Correlating scan output with observed behavior improves confidence, especially when only a small number of ports are open.
- B. Incorrect.
Incorrect. The HTTP Server header often identifies web server software, such as Apache or nginx, but it may be removed, modified, proxied, or intentionally misleading. Even when present, it usually does not reliably identify the host operating system. A candidate might choose this because headers are easy to collect, but they are application-layer artifacts, not dependable OS fingerprints.
- C. Incorrect.
Incorrect. A DNS zone transfer, if misconfigured and allowed, can reveal hostnames and infrastructure details, but it does not directly provide operating system information. It is a reconnaissance technique for information gathering, not a reliable OS fingerprinting method. This distractor reflects confusion between enumeration and fingerprinting.
- D. Incorrect.
Incorrect. Banner grabbing on 443 may reveal web server or application details, but TLS/HTTPS services do not inherently provide immutable operating system banners. Certificates, headers, and responses can be customized or masked by reverse proxies, load balancers, and WAFs. The misconception here is assuming encrypted services expose more trustworthy banners than plaintext services.