# OS Fingerprinting and Banner Grabbing

- **URL:** https://hackindex.io/services/hosts/enumeration/os-fingerprinting-and-banner-grabbing
- **Path:** Hosts > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/hosts/enumeration.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-16

OS fingerprinting identifies the operating system running on a target. Banner grabbing collects the version strings that services expose on connection. Both feed directly into CVE matching, exploitation decisions, and service-specific enumeration. Run these after confirming open ports.

## TTL-Based OS Estimation

The quickest OS indicator requires no tooling. Check the TTL value in a ping response:

```bash
ping -c 1 $TARGET_IP
# 64 bytes from 10.10.10.5: icmp_seq=1 ttl=64 time=1.23 ms
```

Common default TTL values:

| TTL | Likely OS |
| --- | --- |
| 64 | Linux / macOS |
| 128 | Windows |
| 255 | Cisco / network device |
| 254 | Solaris / some network devices |

TTL decrements by one per hop, so a target returning TTL 63 is likely Linux one hop away. Treat this as a quick directional indicator before running a proper scan.

## OS Fingerprinting with Nmap

Nmap analyses TCP/IP stack behaviour including initial TTL values, TCP window sizes, IP flags, and response timing to determine the OS:

```bash
nmap -O $TARGET_IP
# Running: Linux 4.X|5.X
# OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
# OS details: Linux 4.15 - 5.8
```

The CPE string maps directly to CVE databases and searchsploit. Confidence below 90% means the fingerprint is ambiguous: use it as a starting point and verify with banner data.

Requires root. Without root, `-O` silently does nothing.

For aggressive detection when nmap returns no match:

```bash
nmap -O --osscan-guess $TARGET_IP
```

`--osscan-guess` forces nmap to print its best guess even when confidence is low.

## Banner Grabbing with Netcat

Connect to a port and read what the service sends on connection:

```bash
nc -nv $TARGET_IP $PORT
```

Many services immediately present a banner identifying software and version:

```
SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.11
220 mail.corp.local ESMTP Postfix (Ubuntu)
220-FileZilla Server 1.2.0

```

The banner is the service's own identification. It often reveals the software name, version, and underlying OS without any authentication required. Take note of any version string: these feed directly into vulnerability checks.

## Banner Grabbing with curl

For HTTP services, the response headers expose the server stack:

```bash
curl -s -I http://$TARGET_IP:$PORT
# HTTP/1.1 200 OK
# Server: Apache/2.4.41 (Ubuntu)
# X-Powered-By: PHP/7.4.3
```

`Server` and `X-Powered-By` identify the web server and runtime. For HTTPS with a self-signed certificate:

```bash
curl -sk -I https://$TARGET_IP:$PORT
```

Not all services disclose version headers. If the `Server` header is suppressed or generic, move to nmap version detection.

## Version Detection with Nmap

`-sV` retrieves banners and probes services to extract structured version data:

```bash
nmap -sV -p $PORT $TARGET_IP
# PORT     STATE SERVICE VERSION
# 22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11
# 80/tcp   open  http    Apache httpd 2.4.41
# 3306/tcp open  mysql   MySQL 5.7.42
```

Run this against confirmed open ports from your initial scan rather than all ports. The `VERSION` column is more reliable than raw banner output because nmap normalises probe responses across service types.

When nmap returns a generic or unknown version, increase probe intensity:

```bash
nmap -sV --version-intensity 9 -p $PORT $TARGET_IP
```

Level 9 is the maximum. It is slower but extracts versions from services that do not respond to standard probes.

## TLS Certificate Inspection

For services using TLS, the certificate often exposes the hostname, organisation name, and internal infrastructure details:

```bash
openssl s_client -connect $TARGET_IP:$PORT 2>/dev/null | openssl x509 -noout -text
```

Key fields: `Subject`, `Subject Alternative Names`, `Issuer`, and `Not After`. Subject Alternative Names frequently reveal internal hostnames, additional services, and the internal domain name of the target environment.

With nmap:

```bash
nmap -sV --script ssl-cert -p $PORT $TARGET_IP
```

## Interpreting Results

The version string is the primary output. Take it directly into:

- Vulnerability research: match software name and version against known CVEs
- Service enumeration: the version determines which features, authentication methods, and attack surface apply
- Exploitation decisions: version confirms whether a specific exploit or technique applies to this target

Outdated software versions with public CVEs are the main signal. Even without a known CVE, version data shapes every subsequent step.

## References

- [Nmap Book: OS Detection](https://nmap.org/book/osdetect.html) - Official documentation on nmap OS fingerprinting methodology and result interpretation
- [Nmap Book: Version Detection](https://nmap.org/book/man-version-detection.html) - Reference for -sV, --version-intensity, and probe behaviour
- [nc(1) OpenBSD manual page](https://man.openbsd.org/nc.1) - Reference for netcat connection options used in banner grabbing