Nmap OS and Service Detection

1. Why Port Numbers Aren't Enough: The Need for Version Detection

When Nmap reports that port 21/tcp is open, it consults its internal database and guesses that the service is FTP. This is a good guess, but it's not a fact. An administrator could be running a different service on that port. More importantly, even if it is an FTP server, there are dozens of different FTP server applications (vsftpd, ProFTPD, Microsoft FTP, etc.), each with hundreds of versions.

A vulnerability is rarely tied to a protocol like "FTP"; it's tied to a specific version of a specific piece of software, like "vsftpd version 2.3.4". To find exploits, you must know the version.

Nmap solves this with version detection, using the -sV flag. When this is enabled, Nmap sends a series of probes to an open port. These probes are designed to elicit a response that reveals the software's identity and version number, often called a "banner."

2. Performing Service Version Detection (-sV)

Let's see this in action. The -sV flag tells Nmap to perform its version detection probes on all open ports found.

As you saw, the VERSION column in the Nmap output becomes populated with rich detail. This is the information you would take to a vulnerability database or a tool like searchsploit to find known exploits.

3. Identifying the Operating System (-O)

Just as we can identify services, we can also identify the underlying operating system. Nmap does this through a process called TCP/IP stack fingerprinting. Every operating system implements the TCP/IP protocols with slight, subtle differences (e.g., initial TCP window sizes, support for specific TCP options, IP packet header fields). Nmap sends a series of unique and sometimes non-standard packets to the target and analyzes the responses. By comparing these responses to a database of known OS fingerprints, Nmap can make a highly accurate guess about the target's OS.

The command for this is -O (for OS), and it requires root privileges (sudo).

The output from an OS scan provides several key pieces of information.

Key takeaway from the reading: OS detection (-O) and version detection (-sV) are powerful on their own, but they are even better together. Sometimes the service banner (-sV) will reveal the OS (e.g., Microsoft-IIS httpd 10.0) when the TCP/IP fingerprint is ambiguous.

4. The Aggressive Scan (-A): Putting It All Together

Since OS and version detection are so often used together, Nmap provides a convenient and powerful option: -A for an "Aggressive" scan.

The -A flag enables:

• Version Detection (-sV)
• OS Detection (-O)
• Script Scanning (-sC): Runs a default set of safe discovery scripts. (We'll cover this in depth in the next lesson).
• Traceroute (--traceroute): Traces the network path to the target.

This is often the go-to scan for general-purpose enumeration once you've identified a live host.

Now, let's watch a detailed walkthrough of an analyst running an aggressive scan and, more importantly, interpreting the results.

5. Hands-On Lab: Enumerating Metasploitable2

It's time to put this into practice in your own lab. Make sure your Kali and Metasploitable2 VMs are running and can communicate with each other.

1. Find your target's IP: If you don't have it handy, use ip a on Metasploitable2 or run a ping scan from Kali (nmap -sn <your_network>/24).

2. Run an Aggressive Scan: In your Kali terminal, run a comprehensive scan against your Metasploitable2 target. We will add -T4 to speed it up slightly. The command will save the output in all three major Nmap formats (.nmap, .xml, and the human-readable .gnmap) for future use.

   sudo nmap -A -T4 -oA metasploitable_scan <metasploitable_IP>
   

   This scan will take a few minutes. While it runs, Nmap will provide real-time status updates.

3. Interpret the Output: Once the scan is complete, the results will be on your screen. You can also view the saved file with cat metasploitable_scan.nmap. Analyze the output to answer the following questions:

   • What operating system and kernel version did Nmap detect?
   • Look at port 21. What FTP server software and version is running?
   • Look at port 22. What SSH software and version is running?
   • Look at port 80. What is the web server and its version?
   • What is the exact version of the Samba smbd service running? (Hint: check ports 139 and 445).

This exercise is the core of this lesson. You are actively interpreting the data to build an intelligence profile of a target, a fundamental skill in penetration testing.

Conclusion

You have now moved beyond just finding open "doors" to peeking inside and identifying what's behind them. This level of detail is what separates a basic port scan from professional enumeration.

Key Takeaways:

• Version Detection (-sV) is essential for identifying the specific software and version on a port, which is required for vulnerability matching.
• OS Detection (-O) uses TCP/IP stack fingerprinting to determine the target's operating system.
• The Aggressive Scan (-A) is your go-to command for comprehensive enumeration, combining OS detection, version detection, script scanning, and traceroute into one.
• The ultimate goal is to interpret the output to build a detailed profile of the target machine, which informs your next steps in a penetration test.

Next Lesson Preview:
The -A scan you just ran also included -sC, which executes default Nmap scripts. In the next lesson, we will focus entirely on the Nmap Scripting Engine (NSE). You will learn how to find and use specific scripts to actively probe services for known vulnerabilities and misconfigurations, taking your enumeration skills to the next level.