312-50 Question 75
Single answerFingerprinting)During an authorized internal assessment, you identify a Linux server that responds on TCP 80 and 22. The client wants you to determine the host's operating system as accurately as possible while minimizing the chance of causing service disruption or being blocked by network monitoring. Which approach is the BEST choice for OS fingerprinting in this situation?
- A
Use Nmap with a SYN scan and OS detection against the target, for example: nmap -sS -O
- B
Use Nmap with aggressive scan options, for example: nmap -A -T5
, to get OS, version, script, and traceroute results as fast as possible - C
Send malformed TCP packets manually to the target to observe crash behavior and infer the OS from how the stack fails
- D
Rely only on the SSH login banner and the HTTP Server header to definitively identify the operating system without active probing
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Nmap with SYN scanning and OS detection because it provides a practical, low-impact method for active fingerprinting. In real engagements, OS fingerprinting is commonly performed by analyzing how a target's TCP/IP stack responds to crafted probes. Nmap documents OS detection under the -O option and explains that it relies on multiple packet-response tests to match the target against a fingerprint database. This is generally more reliable than inferring the OS solely from service banners.
The distractors reflect common mistakes. Many candidates overuse -A because it is convenient, but aggressive scanning is not always the best operational choice when stealth and stability matter. Another misconception is equating banner grabbing with OS identification; banners may expose software or be intentionally misleading. Finally, destabilizing tests with malformed packets are not appropriate for standard CEH-style reconnaissance and fingerprinting tasks unless explicitly in scope.
Best practice is to combine low-impact active fingerprinting with passive observations where possible, then correlate the results. Relevant references include Nmap's official documentation on SYN scanning (-sS) and OS detection (-O), as well as standard reconnaissance guidance in ethical hacking methodologies that emphasize least disruptive techniques first.
- A. Correct.
Correct. A SYN scan combined with Nmap OS detection is an appropriate balance between accuracy and low impact in an authorized assessment. The -sS option is a half-open scan that is generally less intrusive than a full TCP connect scan, and -O uses TCP/IP stack fingerprinting to estimate the operating system based on packet-response characteristics such as TCP window size, flags, and sequence generation behavior. This is a standard, practical approach for active OS fingerprinting when you need good accuracy without unnecessary noise.
- B. Incorrect.
Incorrect. Nmap's -A enables aggressive features including OS detection, version detection, default NSE scripts, and traceroute. While useful in some cases, it is not the best choice here because the scenario emphasizes minimizing disruption and avoiding detection. The -T5 timing template further increases scan speed and noisiness, which can trigger IDS/IPS controls or create unnecessary load. This option prioritizes speed and breadth over stealth and minimal impact.
- C. Incorrect.
Incorrect. Sending malformed packets specifically to observe crash behavior is unsafe, unnecessary, and contrary to the requirement to minimize service disruption. Ethical hackers should avoid techniques that could destabilize systems unless explicitly authorized for destructive testing. Modern fingerprinting methods infer the OS from normal protocol behavior, not by attempting to crash the target.
- D. Incorrect.
Incorrect. Service banners can provide useful clues, but they are not definitive for OS identification. SSH and HTTP headers often reveal application versions or administrator-configured strings, and they can be intentionally modified or proxied. Banner grabbing is better classified as service/application fingerprinting, not reliable standalone OS fingerprinting. Depending only on banners can lead to false conclusions.