Skip to content
HackIndex logo

HackIndex

OS Fingerprinting and Banner Grabbing

4 min read Mar 16, 2026

OS fingerprinting identifies the operating system running on a target. Banner grabbing collects the version strings that services expose on connection. Both feed directly into CVE matching, exploitation decisions, and service-specific enumeration. Run these after confirming open ports.

TTL-Based OS Estimation

The quickest OS indicator requires no tooling. Check the TTL value in a ping response:

┌──(kali㉿kali)-[~]
└─$ ping -c 1 $TARGET_IP 
64 bytes from 10.10.10.5: icmp_seq=1 ttl=64 time=1.23 ms

Common default TTL values:

TTL

Likely OS

64

Linux / macOS

128

Windows

255

Cisco / network device

254

Solaris / some network devices

TTL decrements by one per hop, so a target returning TTL 63 is likely Linux one hop away. Treat this as a quick directional indicator before running a proper scan.

OS Fingerprinting with Nmap

Nmap analyses TCP/IP stack behaviour including initial TTL values, TCP window sizes, IP flags, and response timing to determine the OS:

┌──(kali㉿kali)-[~]
└─$ nmap -O $TARGET_IP 
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8

The CPE string maps directly to CVE databases and searchsploit. Confidence below 90% means the fingerprint is ambiguous — use it as a starting point and verify with banner data.

Requires root. Without root, -O silently does nothing.

For aggressive detection when nmap returns no match:

┌──(kali㉿kali)-[~]
└─$ nmap -O --osscan-guess $TARGET_IP

--osscan-guess forces nmap to print its best guess even when confidence is low.

Connect to a port and read what the service sends on connection:

┌──(kali㉿kali)-[~]
└─$ nc -nv $TARGET_IP $PORT

Many services immediately present a banner identifying software and version:

SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.11
220 mail.corp.local ESMTP Postfix (Ubuntu)
220-FileZilla Server 1.2.0

The banner is the service's own identification. It often reveals the software name, version, and underlying OS without any authentication required. Take note of any version string — these feed directly into vulnerability checks.

For HTTP services, the response headers expose the server stack:

┌──(kali㉿kali)-[~]
└─$ curl -s -I http://$TARGET_IP:$PORT 
HTTP/1.1 200 OK
Server: Apache/2.4.41 (Ubuntu)
X-Powered-By: PHP/7.4.3

Server and X-Powered-By identify the web server and runtime. For HTTPS with a self-signed certificate:

┌──(kali㉿kali)-[~]
└─$ curl -sk -I https://$TARGET_IP:$PORT

Not all services disclose version headers. If the Server header is suppressed or generic, move to nmap version detection.

Version Detection with Nmap

-sV retrieves banners and probes services to extract structured version data:

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p $PORT $TARGET_IP 
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11
80/tcp   open  http    Apache httpd 2.4.41
3306/tcp open  mysql   MySQL 5.7.42

Run this against confirmed open ports from your initial scan rather than all ports. The VERSION column is more reliable than raw banner output because nmap normalises probe responses across service types.

When nmap returns a generic or unknown version, increase probe intensity:

┌──(kali㉿kali)-[~]
└─$ nmap -sV --version-intensity 9 -p $PORT $TARGET_IP

Level 9 is the maximum. It is slower but extracts versions from services that do not respond to standard probes.

TLS Certificate Inspection

For services using TLS, the certificate often exposes the hostname, organisation name, and internal infrastructure details:

┌──(kali㉿kali)-[~]
└─$ openssl s_client -connect $TARGET_IP:$PORT 2>/dev/null | openssl x509 -noout -text

Key fields: Subject, Subject Alternative Names, Issuer, and Not After. Subject Alternative Names frequently reveal internal hostnames, additional services, and the internal domain name of the target environment.

With nmap:

┌──(kali㉿kali)-[~]
└─$ nmap -sV --script ssl-cert -p $PORT $TARGET_IP

Interpreting Results

The version string is the primary output. Take it directly into:

  • Vulnerability research: match software name and version against known CVEs

  • Service enumeration: the version determines which features, authentication methods, and attack surface apply

  • Exploitation decisions: version confirms whether a specific exploit or technique applies to this target

Outdated software versions with public CVEs are the main signal. Even without a known CVE, version data shapes every subsequent step.

References