當前位置：首頁 > 运维知识 > windows >内容正文

windows

【安全牛学习笔记】操作系统识别

發布時間：2025/3/21 windows 17 豆豆

生活随笔收集整理的這篇文章主要介紹了【安全牛学习笔记】操作系统识别小編覺得挺不錯的,現在分享給大家,幫大家做個參考.

該筆記為安全牛課堂學員筆記，想看此課程或者信息安全類干貨可以移步到安全牛課堂

Security+認證為什么是互聯網+時代最火爆的認證？

? ? ??牛妹先給大家介紹一下Security+

? ? ? ? Security+ 認證是一種中立第三方認證，其發證機構為美國計算機行業協會CompTIA ；是和CISSP、ITIL 等共同包含在內的國際 IT 業 10 大熱門認證之一，和CISSP偏重信息安全管理相比，Security+ 認證更偏重信息安全技術和操作。

? ? ? ?通過該認證證明了您具備網絡安全，合規性和操作安全，威脅和漏洞，應用程序、數據和主機安全，訪問控制和身份管理以及加密技術等方面的能力。因其考試難度不易，含金量較高，目前已被全球企業和安全專業人士所普遍采納。

Security+認證如此火爆的原因？

? ? ? ??

? ? ? ?原因一：在所有信息安全認證當中，偏重信息安全技術的認證是空白的，?Security+認證正好可以彌補信息安全技術領域的空白。

? ??? 目前行業內受認可的信息安全認證主要有CISP和CISSP，但是無論CISP還是CISSP都是偏重信息安全管理的，技術知識講的寬泛且淺顯，考試都是一帶而過。而且CISSP要求持證人員的信息安全工作經驗都要5年以上，CISP也要求大專學歷4年以上工作經驗，這些要求無疑把有能力且上進的年輕人的持證之路堵住。在現實社會中，無論是找工作還是升職加薪，或是投標時候報人員，認證都是必不可少的，這給年輕人帶來了很多不公平。而Security+的出現可以掃清這些年輕人職業發展中的障礙，由于Security+偏重信息安全技術，所以對工作經驗沒有特別的要求。只要你有IT相關背景，追求進步就可以學習和考試。

? ? ???原因二：?IT運維人員工作與翻身的利器。

? ? ???在銀行、證券、保險、信息通訊等行業，IT運維人員非常多，IT運維涉及的工作面也非常廣。是一個集網絡、系統、安全、應用架構、存儲為一體的綜合性技術崗。雖然沒有程序猿們“生當做光棍，死亦寫代碼”的悲壯，但也有著“鋤禾日當午，不如運維苦“的感慨。天天對著電腦和機器，時間長了難免有對于職業發展的迷茫和困惑。Security+國際認證的出現可以讓有追求的IT運維人員學習網絡安全知識，掌握網絡安全實踐。職業發展朝著網絡安全的方向發展，解決國內信息安全人才的匱乏問題。另外，即使不轉型，要做好運維工作，學習安全知識取得安全認證也是必不可少的。

? ? ? ? 原因三：接地氣、國際范兒、考試方便、費用適中！

CompTIA作為全球ICT領域最具影響力的全球領先機構,在信息安全人才認證方面是專業、公平、公正的。Security+認證偏重操作且和一線工程師的日常工作息息相關。適合銀行、證券、保險、互聯網公司等IT相關人員學習。作為國際認證在全球147個國家受到廣泛的認可。

? ? ? ? 在目前的信息安全大潮之下，人才是信息安全發展的關鍵。而目前國內的信息安全人才是非常匱乏的，相信Security+認證一定會成為最火爆的信息安全認證。

?近期，安全牛課堂在做此類線上培訓，感興趣可以了解

操作系統識別

╋━━━━━━━━━━━━━━━╋

┃操作系統識別? ? ? ? ? ? ? ? ? ┃

┃操作系統識別技術? ? ? ? ? ? ? ┃

┃? 總類繁多? ? ? ? ? ? ? ? ? ? ┃

┃? 好產品采用多種技術組合? ? ? ┃

┃TTL起始值? ? ? ? ? ? ? ? ? ? ?┃

┃? Windows: 128 (65-----128)? ?┃

┃? Linux/Unix: 60 (1-64)? ? ? ?┃

┃? 某些Unix: 255? ? ? ? ? ? ? ?┃

╋━━━━━━━━━━━━━━━╋

┃操作系統識別? ? ? ? ? ? ? ? ? ┃

┃python? ? ? ? ? ? ? ? ? ? ? ? ┃

┃? from scapy.all import? ? ? ?┃

┃? win="1.1.1.1"? ? ? ? ? ? ? ?┃

┃? linu="1.1.1.2"? ? ? ? ? ? ? ┃

┃? aw=sr1(IP(dst=win)/ICMP())? ┃

┃? al=sr1(IP(dst=linu)/ICMP()) ┃

┃? if a[IP].ttl<=64? ? ? ? ? ? ┃

┃? ? ? print "host is Linux"? ?┃

┃? else? ? ? ? ? ? ? ? ? ? ? ? ┃

┃? ? ? print "host is windows" ┃

┃? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ┃

┃./ttl_os.py? ? ? ? ? ? ? ? ? ?┃

╋━━━━━━━━━━━━━━━╋

╭────────────────────────────────────────────╮

[ttl_os.py]

#!/usr/bin/python

from scapy.all import *

import loggging

logging.getLogger("scapy.runtime").setLevel(logging.ERROR)

import sys

if len(sys.argv)!=2:

? print "Usage - ./ttl_os.py [IP Address]"

? print "Example - ./ttl_os.py 10.0.0.5"

? print "Example will perform ttl analysis to attempt to determine whether the system is windows or Linux"

? sys.exit()

ip=sys.argv[1]

ans=sr1(IP(dst=str(ip))/ICMP(),timeout=1,verbose=0)

if ans == None:

? print "No response was returned"

elif int(ans[IP].ttl)<=64:

? print "Host is Linux/Unix"

else:

? print "Host is Windows"

╰────────────────────────────────────────────╯

root@kali:~# chmod u+x ttl_os.py

root@kali:~# ./ttl_os.py 192.168.1.133

WARNING: No route found for IPv6 destination :: (no default route?)

Host is Windows

root@kali:~# ./ttl_os.py 192.168.1.134

WARNING: No route found for IPv6 destination :: (no default route?)

Host is Linux/Unix

root@kali:~# ./ttl_os.py 192.168.1.1

WARNING: No route found for IPv6 destination :: (no default route?)

Host is Linux/Unix

╋━━━━━━━━━━━━━━━╋

┃操作系統識別? ? ? ? ? ? ? ? ? ┃

┃nmap使用多種技術識別操作系統? ┃

┃? nmap 1.1.1.1 -O? ? ? ? ? ? ?┃

┃? 系統服務特征? ? ? ? ? ? ? ? ┃

╋━━━━━━━━━━━━━━━╋

root@kali:~# nmap -O 192.138.1.133

Starting Nmap 6.49BETA5 ( https://nmap.org ) at 2015-10-05 01:24 CST

Nmap scan report for 192.138.1.133

Host is up (0.00073s latency).

PORT? ? ? STATE SERVICE

135/tcp? ?open? msrpc

139/tcp? ?open? netbios- ssn

445/tcp? ?open? microsoft-ds

3389/tcp? open? ms-wbt-server

MAC Address: 80:00:27:B0:3A:76(Cadmus Computer Systems)

Device type: general purpose

Running: Microsoft Windows XP

OS CPE: cpe:/o:microsoft:windows_xp::sp2 cpe:/o:microsoft:windows_xp::sp3

OS details: microsoft Windos XP SP2 or SP3

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 7.47 seconds

root@kali:~# nmap -O 192.138.1.134

tarting Nmap 6.49BETA5 ( https://nmap.org ) at 2015-10-05 01:24 CST

Nmap scan report for 192.138.1.133

Host is up (0.00073s latency).

PORT? ? ?STATE SERVICE

21/tcp? ?open? ftp

22/tcp? ?open? ssh

23/tcp? ?open? telnet

25/tcp? ?open? smtb

53/tcp? ?open? domain

80/tcp? ?open? http

111/tcp? open? rpcbind

139/tcp? open? netbios-ssn

445/tcp? open? microsoft-ds

512/tcp? open? exec

513/tcp? open? login

514/tcp? open? shell

1099/tcp open? rmiregistry

1524/tcp open? ingreslock

2049/tcp open? nfs

2121/tcp open? ccproxy-ftp

3306/tcp open? mysql

5432/tcp open? postgresql

5900/tcp open? vnc

6000/tcp open? X11

6667/tcp open? irc

8009/tcp open? ajp13

8180/tcp open? unknown

MAC Address: 80:00:27:B0:3A:76(Cadmus Computer Systems)

Device type: general purpose

Running: Linux 2.6.X

OS CPE: cpe:/o: linux: linux_kernel:2.6

OS details: Linux 2.6.9 - 2.6.33

Network Distance: 1 hop

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 7.47 seconds

root@kali:~# nmap -O 192.138.1.1

Starting Nmap 6.49BETA5 ( https://nmap.org ) at 2015-10-03 16:31 CST

Nmap scan report for 192.168.1.1

Host is up (0.00082s latency).

PORT? ? ?STATE SERVICE

80/tcp? ?open? http

1900/tcp open? upup

MAC Address: Do:C7:C0:99:ED:3A (Tp-link Technologies Co.)

Warning: OSScan results may be unrelibale because we coule not find at least 1 open and 1 closed port

Aggressive OS guesses: Canon p_w_picpathRUNNER C5185 printer (98%), VxWorks(94%), Can on p_w_picpathRUNNER C2380i pinter(93%), Fujitsu Externus DX80 or IBM DCS9900 NAS divie(93%), Avaya 4526GTX switch (92%), HP ProCurve 3500yl,5406zl, or 6200yl switch or UTStarcom F100 VoIP phone(89%), Nortel CS1000M VoIP PBX or Xerox Phaser 8560DT printer(88%)

No exact OS matches for host (test conditions non-ideal).

Network distance: 1 hop

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 7.47 seconds

root@kali:~# xpro

xprobe2? xpro

root@kali:~# xprobe2 192.168.1.133? ? ? ? ? ? ? //專門識別操作系統的一個工具

? ? ? ? ? ? ? ? ? ? ? ? ? ? ?Xprobe2：主動操作系統指紋工具

? ? XProbe是一款遠程主機操作系統探查工具。開發者基于和Nmap相同的一些技術（same techniques），并加入了自己的創新。Xprobe通過ICMP協議來獲得指紋。最新版本是Xprobe2.0.3版本,Xprobe2通過模糊矩陣統計分析主動探測數據報對應的ICMP數據報特征,進而探測得到遠端操作系統的類型。注:經過本人測試,對比較老的操作系統,識別效果非常高,對新內核系統則識別效果不太準確。

? ? 下載鏈接：html">http://www.2cto.com/Soft/201012/25526.html

? ? 安裝步驟：

? ? #tar -zxvf? xprobe2-0.3.tar.gz

? ? #./configure --prefix=/usr/loca/

? ? # make

? ? #make install

? ? ?用法:

? ? #/usr/local/xprobe/bin/xprobe2 -h

? ?Options:

? ? ? ? ? ? ? -v? ? ? ? ? ? ? ? ? ? ? ?Be verbose

? ? ? ? ? ? ? -r? ? ? ? ? ? ? ? ? ? ? ?Show route to target(traceroute)

? ? ? ? ? ? ? -p Specify portnumber, protocol and state.

? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?Example: tcp:23:open, UDP:53:CLOSED

? ? ? ? ? ? ? -c? ? ? ? ? ?Specify config file to use.

? ? ? ? ? ? ? -h? ? ? ? ? ? ? ? ? ? ? ?Print this help.

? ? ? ? ? ? ? -o? ? ? ? ? ? ? ? Use logfile to log everything.

? ? ? ? ? ? ? -t? ? ? ? ? ? ?Set initial receive timeout or roundtrip time.

? ? ? ? ? ? ? -s? ? ? ? ? ?Set packsending delay (milseconds).

? ? ? ? ? ? ? -d? ? ? ? ? ? ? Specify debugging level.

? ? ? ? ? ? ? -D? ? ? ? ? ? ? ?Disable module number .

? ? ? ? ? ? ? -M? ? ? ? ? ? ? ?Enable module number .

? ? ? ? ? ? ? -L? ? ? ? ? ? ? ? ? ? ? ?Display modules.

? ? ? ? ? ? ? -m? ? ? ? ?Specify number of matches to print.

? ? ? ? ? ? ? -T? ? ? ? ? ? ?Enable TCP portscan for specified port(s).

? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?Example: -T21-23,53,110

? ? ? ? ? ? ? -U? ? ? ? ? ? ?Enable UDP portscan for specified port(s).

? ? ? ? ? ? ? -f? ? ? ? ? ? ? force fixed round-trip time (-t opt).

? ? ? ? ? ? ? -F? ? ? ? ? Generate signature (use -o to save to a file).

? ? ? ? ? ? ? -X? ? Generate XML output and save it to logfile specified with -o.

? ? ? ? ? ? ? -B? ?Options forces TCP handshake module to try to guess open TCP port

? ? ? ? ? ? ? -A? ?Perform analysis of sample packets gathered during portscan in

? ? ? ? ? ? ? ? ? ? order to detect suspicious traffic (i.e. transparent proxies,

? ? ? ? ? firewalls/NIDSs resetting connections). Use with -T.

? ? 以上個選項,讀者可自己去測試。本人給出一個簡單的測試，假設當前目錄在/usr/local/xprobe/bin/下

? ? #./xprobe2 www.163.com

? ? ?meder@o0o.nu

? ? [+] Target is www.163.com

? ? [+] Loading modules.

? ? [+] Following modules are loaded:

? ? [x] [1] ping:icmp_ping? -? ICMP echo discovery module

? ? [x] [2] ping:tcp_ping? -? TCP-based ping discovery module

? ? [x] [3] ping:udp_ping? -? UDP-based ping discovery module

? ? [x] [4] infogather:ttl_calc? -? TCP and UDP based TTL distance calculation

? ? [x] [5] infogather:portscan? -? TCP and UDP PortScanner

? ? [x] [6] fingerprint:icmp_echo? -? ICMP Echo request fingerprinting module

? ? [x] [7] fingerprint:icmp_tstamp? -? ICMP Timestamp request fingerprinting module

? ? [x] [8] fingerprint:icmp_amask? -? ICMP Address mask request fingerprinting module

? ? [x] [9] fingerprint:icmp_port_unreach? -? ICMP port unreachable fingerprinting module

? ? [x] [10] fingerprint:tcp_hshake? -? TCP Handshake fingerprinting module

? ? [x] [11] fingerprint:tcp_rst? -? TCP RST fingerprinting module

? ? [x] [12] fingerprint:smb? -? SMB fingerprinting module

? ? [x] [13] fingerprint:snmp? -? SNMPv2c fingerprinting module

? ? [+] 13 modules registered

? ? [+] Initializing scan engine

? ? [+] Running scan engine

? ? [-] ping:tcp_ping module: no closed/open TCP ports known on 220.181.28.51.?

? ? Module test failed

? ? [-] ping:udp_ping module: no closed/open UDP ports known on 220.181.28.51.?

? ? Module test failed

? ? [-] No distance calculation. 220.181.28.51 appears to be dead or no ports known

? ? [+] Host: 220.181.28.51 is up (Guess probability: 50%)

? ? [+] Target: 220.181.28.51 is alive. Round-Trip Time: 0.02320 sec

? ? [+] Selected safe Round-Trip Time value is: 0.04640 sec

? ? [-] fingerprint:tcp_hshake Module execution aborted (no open TCP ports known)

? ? [-] fingerprint:smb need either TCP port 139 or 445 to run

? ? [-] fingerprint:snmp: need UDP port 161 open

? ? [+] Primary guess:

? ? [+] Host 220.181.28.51 Running OS: "Linux Kernel 2.6.6" (Guess probability: 100%)

? ? [+] Other guesses:

? ? [+] Host 220.181.28.51 Running OS: "Linux Kernel 2.6.7" (Guess probability: 100%)

? ? [+] Host 220.181.28.51 Running OS: "Linux Kernel 2.6.8" (Guess probability: 100%)

? ? [+] Host 220.181.28.51 Running OS: "Linux Kernel 2.6.9" (Guess probability: 100%)

? ? [+] Host 220.181.28.51 Running OS: "Linux Kernel 2.6.10" (Guess probability: 100%)

? ? [+] Host 220.181.28.51 Running OS: "Linux Kernel 2.6.11" (Guess probability: 100%)

? ? [+] Host 220.181.28.51 Running OS: "Linux Kernel 2.6.5" (Guess probability: 100%)

? ? [+] Host 220.181.28.51 Running OS: "Linux Kernel 2.6.4" (Guess probability: 100%)

? ? [+] Host 220.181.28.51 Running OS: "Linux Kernel 2.6.0" (Guess probability: 100%)

? ? [+] Host 220.181.28.51 Running OS: "Linux Kernel 2.6.1" (Guess probability: 100%)

? ? [+] Cleaning up scan engine

? ? [+] Modules deinitialized

? ? [+] Execution completed

╋━━━━━━━━━━━━━━━╋

┃操作系統識別? ? ? ? ? ? ? ? ? ┃

┃被動操作系統識別? ? ? ? ? ? ? ┃

┃? IDS? ? ? ? ? ? ? ? ? ? ? ? ?┃

┃? 抓包分析? ? ? ? ? ? ? ? ? ? ┃

┃被動掃描? ? ? ? ? ? ? ? ? ? ? ┃

┃p0f? ? ? ? ? ? ? ? ? ? ? ? ? ?┃

┃? 結合ARP地址欺騙識別全網OS? ?┃

╋━━━━━━━━━━━━━━━╋

root@kali:~# p0f

--- p0f 3.07b by Michal Zalewski <lcamtuf@coredump.cx> ---

[+] Closed 1 file descriptor.

[+] Loaded 320 signatures from 'p0f.fp'.

[+] Intercepting traffic on default interface 'eth0'.

[+] Default packet filtering configured [+VLAN].

[+] Entered main event loop.

.-[ 192.168.1.107/50093 -> 64.233.187.136/443 (syn) ]-

| client? ?= 192.168.1.107/50093

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/50093 -> 64.233.187.136/443 (mtu) ]-

| client? ?= 192.168.1.107/50093

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/50094 -> 64.233.187.136/443 (syn) ]-

| client? ?= 192.168.1.107/50094

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/50094 -> 64.233.187.136/443 (mtu) ]-

| client? ?= 192.168.1.107/50094

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/50094 -> 64.233.187.136/443 (uptime) ]-

| client? ?= 192.168.1.107/50094

| uptime? ?= 0 days 0 hrs 8 min (modulo 198 days)

| raw_freq = 250.00 Hz

`----

^C[!] WARNING: User-initiated shutdown.

All done. Processed 10 packets.

root@kali:~# p0f

--- p0f 3.07b by Michal Zalewski <lcamtuf@coredump.cx> ---

[+] Closed 1 file descriptor.

[+] Loaded 320 signatures from 'p0f.fp'.

[+] Intercepting traffic on default interface 'eth0'.

[+] Default packet filtering configured [+VLAN].

[+] Entered main event loop.

.-[ 192.168.1.107/54895 -> 180.97.33.107/80 (syn) ]-

| client? ?= 192.168.1.107/54895

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/54895 -> 180.97.33.107/80 (mtu) ]-

| client? ?= 192.168.1.107/54895

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/54895 -> 180.97.33.107/80 (syn+ack) ]-

| server? ?= 180.97.33.107/80

| os? ? ? ?= ???

| dist? ? ?= 9

| params? ?= none

| raw_sig? = 4:55+9:0:1440:mss*20,7:mss,sok,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/54895 -> 180.97.33.107/80 (mtu) ]-

| server? ?= 180.97.33.107/80

| link? ? ?= IPIP or SIT

| raw_mtu? = 1480

`----

.-[ 192.168.1.107/54895 -> 180.97.33.107/80 (http request) ]-

| client? ?= 192.168.1.107/54895

| app? ? ? = Firefox 10.x or newer

| lang? ? ?= English

| params? ?= none

| raw_sig? = 1:Host,User-Agent,Accept=[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8],Accept-Language=[en-US,en;q=0.5],Accept-Encoding=[gzip, deflate],?Cookie,Connection=[keep-alive]:Accept-Charset,Keep-Alive:Mozilla/5.0 (X11; Linux i686; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.3.0

`----

-[ 192.168.1.107/54895 -> 180.97.33.107/80 (http response) ]-

| server? ?= 180.97.33.107/80

| app? ? ? = ???

| lang? ? ?= none

| params? ?= none

| raw_sig? = 1:Date,Content-Type,?Content-Length,Connection=[Keep-Alive],?Location,Server,X-UA-Compatible=[IE=Edge,chrome=1],?Set-Cookie:Keep-Alive,Accept-Ranges:BWS/1.1

`----

.-[ 192.168.1.107/57542 -> 180.97.33.107/443 (syn) ]-

| client? ?= 192.168.1.107/57542

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/57542 -> 180.97.33.107/443 (mtu) ]-

| client? ?= 192.168.1.107/57542

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/57542 -> 180.97.33.107/443 (uptime) ]-

| client? ?= 192.168.1.107/57542

| uptime? ?= 0 days 0 hrs 8 min (modulo 198 days)

| raw_freq = 258.62 Hz

`----

.-[ 192.168.1.107/57542 -> 180.97.33.107/443 (syn+ack) ]-

| server? ?= 180.97.33.107/443

| os? ? ? ?= ???

| dist? ? ?= 9

| params? ?= none

| raw_sig? = 4:55+9:0:1440:mss*20,7:mss,sok,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/57542 -> 180.97.33.107/443 (mtu) ]-

| server? ?= 180.97.33.107/443

| link? ? ?= IPIP or SIT

| raw_mtu? = 1480

`----

.-[ 192.168.1.107/33274 -> 58.215.118.32/443 (syn) ]-

| client? ?= 192.168.1.107/33274

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/33274 -> 58.215.118.32/443 (mtu) ]-

| client? ?= 192.168.1.107/33274

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/33274 -> 58.215.118.32/443 (uptime) ]-

| client? ?= 192.168.1.107/33274

| uptime? ?= 0 days 0 hrs 8 min (modulo 198 days)

| raw_freq = 249.49 Hz

`----

.-[ 192.168.1.107/33274 -> 58.215.118.32/443 (syn+ack) ]-

| server? ?= 58.215.118.32/443

| os? ? ? ?= ???

| dist? ? ?= 9

| params? ?= none

| raw_sig? = 4:55+9:0:1440:mss*20,2:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/33274 -> 58.215.118.32/443 (mtu) ]-

| server? ?= 58.215.118.32/443

| link? ? ?= IPIP or SIT

| raw_mtu? = 1480

`----

.-[ 192.168.1.107/57544 -> 180.97.33.107/443 (syn) ]-

| client? ?= 192.168.1.107/57544

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/57544 -> 180.97.33.107/443 (mtu) ]-

| client? ?= 192.168.1.107/57544

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/57544 -> 180.97.33.107/443 (uptime) ]-

| client? ?= 192.168.1.107/57544

| uptime? ?= 0 days 0 hrs 8 min (modulo 198 days)

| raw_freq = 252.34 Hz

`----

.-[ 192.168.1.107/57544 -> 180.97.33.107/443 (syn+ack) ]-

| server? ?= 180.97.33.107/443

| os? ? ? ?= ???

| dist? ? ?= 9

| params? ?= none

| raw_sig? = 4:55+9:0:1440:mss*20,7:mss,sok,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/57544 -> 180.97.33.107/443 (mtu) ]-

| server? ?= 180.97.33.107/443

| link? ? ?= IPIP or SIT

| raw_mtu? = 1480

`----

.-[ 192.168.1.107/42700 -> 58.215.118.33/443 (syn) ]-

| client? ?= 192.168.1.107/42700

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/42700 -> 58.215.118.33/443 (mtu) ]-

| client? ?= 192.168.1.107/42700

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/42700 -> 58.215.118.33/443 (uptime) ]-

| client? ?= 192.168.1.107/42700

| uptime? ?= 0 days 0 hrs 8 min (modulo 198 days)

| raw_freq = 233.33 Hz

`----

.-[ 192.168.1.107/42701 -> 58.215.118.33/443 (syn) ]-

| client? ?= 192.168.1.107/42701

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/42701 -> 58.215.118.33/443 (mtu) ]-

| client? ?= 192.168.1.107/42701

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/42702 -> 58.215.118.33/443 (syn) ]-

| client? ?= 192.168.1.107/42702

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/42702 -> 58.215.118.33/443 (mtu) ]-

| client? ?= 192.168.1.107/42702

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/42700 -> 58.215.118.33/443 (syn+ack) ]-

| server? ?= 58.215.118.33/443

| os? ? ? ?= ???

| dist? ? ?= 9

| params? ?= none

| raw_sig? = 4:55+9:0:1440:mss*20,2:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/42700 -> 58.215.118.33/443 (mtu) ]-

| server? ?= 58.215.118.33/443

| link? ? ?= IPIP or SIT

| raw_mtu? = 1480

`----

.-[ 192.168.1.107/42702 -> 58.215.118.33/443 (syn+ack) ]-

| server? ?= 58.215.118.33/443

| os? ? ? ?= ???

| dist? ? ?= 9

| params? ?= none

| raw_sig? = 4:55+9:0:1440:mss*20,2:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/42702 -> 58.215.118.33/443 (mtu) ]-

| server? ?= 58.215.118.33/443

| link? ? ?= IPIP or SIT

| raw_mtu? = 1480

`----

.-[ 192.168.1.107/42701 -> 58.215.118.33/443 (syn+ack) ]-

| server? ?= 58.215.118.33/443

| os? ? ? ?= ???

| dist? ? ?= 9

| params? ?= none

| raw_sig? = 4:55+9:0:1440:mss*20,2:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/42701 -> 58.215.118.33/443 (mtu) ]-

| server? ?= 58.215.118.33/443

| link? ? ?= IPIP or SIT

| raw_mtu? = 1480

`----

.-[ 192.168.1.107/42703 -> 58.215.118.33/443 (syn) ]-

| client? ?= 192.168.1.107/42703

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/42703 -> 58.215.118.33/443 (mtu) ]-

| client? ?= 192.168.1.107/42703

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/42703 -> 58.215.118.33/443 (syn+ack) ]-

| server? ?= 58.215.118.33/443

| os? ? ? ?= ???

| dist? ? ?= 9

| params? ?= none

| raw_sig? = 4:55+9:0:1440:mss*20,2:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/42703 -> 58.215.118.33/443 (mtu) ]-

| server? ?= 58.215.118.33/443

| link? ? ?= IPIP or SIT

| raw_mtu? = 1480

`----

.-[ 192.168.1.107/42703 -> 58.215.118.33/443 (uptime) ]-

| client? ?= 192.168.1.107/42703

| uptime? ?= 0 days 0 hrs 8 min (modulo 198 days)

| raw_freq = 261.90 Hz

`----

.-[ 192.168.1.107/33280 -> 58.215.118.32/443 (syn) ]-

| client? ?= 192.168.1.107/33280

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/33280 -> 58.215.118.32/443 (mtu) ]-

| client? ?= 192.168.1.107/33280

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/33280 -> 58.215.118.32/443 (uptime) ]-

| client? ?= 192.168.1.107/33280

| uptime? ?= 0 days 0 hrs 8 min (modulo 198 days)

| raw_freq = 250.87 Hz

`----

.-[ 192.168.1.107/33281 -> 58.215.118.32/443 (syn) ]-

| client? ?= 192.168.1.107/33281

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/33281 -> 58.215.118.32/443 (mtu) ]-

| client? ?= 192.168.1.107/33281

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/33280 -> 58.215.118.32/443 (syn+ack) ]-

| server? ?= 58.215.118.32/443

| os? ? ? ?= ???

| dist? ? ?= 9

| params? ?= none

| raw_sig? = 4:55+9:0:1440:mss*20,2:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/33280 -> 58.215.118.32/443 (mtu) ]-

| server? ?= 58.215.118.32/443

| link? ? ?= IPIP or SIT

| raw_mtu? = 1480

`----

.-[ 192.168.1.107/33281 -> 58.215.118.32/443 (syn+ack) ]-

| server? ?= 58.215.118.32/443

| os? ? ? ?= ???

| dist? ? ?= 9

| params? ?= none

| raw_sig? = 4:55+9:0:1440:mss*20,2:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/33281 -> 58.215.118.32/443 (mtu) ]-

| server? ?= 58.215.118.32/443

| link? ? ?= IPIP or SIT

| raw_mtu? = 1480

`----

.-[ 192.168.1.107/57551 -> 180.97.33.107/443 (syn) ]-

| client? ?= 192.168.1.107/57551

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/57551 -> 180.97.33.107/443 (mtu) ]-

| client? ?= 192.168.1.107/57551

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/57551 -> 180.97.33.107/443 (uptime) ]-

| client? ?= 192.168.1.107/57551

| uptime? ?= 0 days 0 hrs 8 min (modulo 198 days)

| raw_freq = 248.83 Hz

`----

.-[ 192.168.1.107/57551 -> 180.97.33.107/443 (syn+ack) ]-

| server? ?= 180.97.33.107/443

| os? ? ? ?= ???

| dist? ? ?= 9

| params? ?= none

| raw_sig? = 4:55+9:0:1440:mss*20,7:mss,sok,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/57551 -> 180.97.33.107/443 (mtu) ]-

| server? ?= 180.97.33.107/443

| link? ? ?= IPIP or SIT

| raw_mtu? = 1480

`----

.-[ 192.168.1.107/38572 -> 180.97.33.108/443 (syn) ]-

| client? ?= 192.168.1.107/38572

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/38572 -> 180.97.33.108/443 (mtu) ]-

| client? ?= 192.168.1.107/38572

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/38572 -> 180.97.33.108/443 (uptime) ]-

| client? ?= 192.168.1.107/38572

| uptime? ?= 0 days 0 hrs 8 min (modulo 198 days)

| raw_freq = 247.93 Hz

`----

.-[ 192.168.1.107/38572 -> 180.97.33.108/443 (syn+ack) ]-

| server? ?= 180.97.33.108/443

| os? ? ? ?= ???

| dist? ? ?= 9

| params? ?= none

| raw_sig? = 4:55+9:0:1440:mss*20,7:mss,sok,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/38572 -> 180.97.33.108/443 (mtu) ]-

| server? ?= 180.97.33.108/443

| link? ? ?= IPIP or SIT

| raw_mtu? = 1480

`----

.-[ 192.168.1.107/50093 -> 64.233.187.136/443 (syn) ]-

| client? ?= 192.168.1.107/50093

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

----

.-[ 192.168.1.107/50093 -> 64.233.187.136/443 (mtu) ]-

| client? ?= 192.168.1.107/50093

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/50093 -> 64.233.187.136/443 (uptime) ]-

| client? ?= 192.168.1.107/50093

| uptime? ?= 0 days 0 hrs 8 min (modulo 198 days)

| raw_freq = 253.38 Hz

`----

.-[ 192.168.1.107/38573 -> 180.97.33.108/443 (syn) ]-

| client? ?= 192.168.1.107/38573

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/38573 -> 180.97.33.108/443 (mtu) ]-

| client? ?= 192.168.1.107/38573

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/38573 -> 180.97.33.108/443 (uptime) ]-

| client? ?= 192.168.1.107/38573

| uptime? ?= 0 days 0 hrs 8 min (modulo 198 days)

| raw_freq = 248.91 Hz

`----

.-[ 192.168.1.107/38573 -> 180.97.33.108/443 (syn+ack) ]-

| server? ?= 180.97.33.108/443

| os? ? ? ?= ???

| dist? ? ?= 9

| params? ?= none

| raw_sig? = 4:55+9:0:1440:mss*20,7:mss,sok,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/38573 -> 180.97.33.108/443 (mtu) ]-

| server? ?= 180.97.33.108/443

| link? ? ?= IPIP or SIT

| raw_mtu? = 1480

`----

.-[ 192.168.1.107/50094 -> 64.233.187.136/443 (syn) ]-

| client? ?= 192.168.1.107/50094

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/50094 -> 64.233.187.136/443 (mtu) ]-

| client? ?= 192.168.1.107/50094

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/50094 -> 64.233.187.136/443 (uptime) ]-

| client? ?= 192.168.1.107/50094

| uptime? ?= 0 days 0 hrs 8 min (modulo 198 days)

| raw_freq = 259.26 Hz

`----

.-[ 192.168.1.107/57554 -> 180.97.33.107/443 (syn) ]-

| client? ?= 192.168.1.107/57554

| os? ? ? ?= Linux 3.11 and newer

| dist? ? ?= 0

| params? ?= none

| raw_sig? = 4:64+0:0:1460:mss*20,10:mss,sok,ts,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/57554 -> 180.97.33.107/443 (mtu) ]-

| client? ?= 192.168.1.107/57554

| link? ? ?= Ethernet or modem

| raw_mtu? = 1500

`----

.-[ 192.168.1.107/57554 -> 180.97.33.107/443 (uptime) ]-

| client? ?= 192.168.1.107/57554

| uptime? ?= 0 days 0 hrs 8 min (modulo 198 days)

| raw_freq = 245.76 Hz

`----

.-[ 192.168.1.107/57554 -> 180.97.33.107/443 (syn+ack) ]-

| server? ?= 180.97.33.107/443

| os? ? ? ?= ???

| dist? ? ?= 9

| params? ?= none

| raw_sig? = 4:55+9:0:1440:mss*20,7:mss,sok,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,ws:df,id+:0

`----

.-[ 192.168.1.107/57554 -> 180.97.33.107/443 (mtu) ]-

| server? ?= 180.97.33.107/443

| link? ? ?= IPIP or SIT

| raw_mtu? = 1480

`----

╋━━━━━━━━━━━━━━━━━━━━━━━━╋

┃SNMP? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ┃

┃snmp? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ┃

┃? 信息的金礦? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ┃

┃? 經常被錯誤配置? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ┃

┃? public / prtvate / manager? ? ? ? ? ? ? ? ? ? ┃

┃MIB Tree? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ┃

┃? SNMP Management Informattion Base (MID)? ? ? ?┃

┃? 樹形的網絡設備管理功能數據庫? ? ? ? ? ? ? ? ? ┃

┃? 1.3.6.1.4.1.77.1.2.25? ? ? ? ? ? ? ? ? ? ? ? ?┃

┃onesixtyone 1.1.1.1 public? ? ? ? ? ? ? ? ? ? ? ┃

┃onesixtyone -c dict.txt -i hosts -o my.log -w 100┃

╋━━━━━━━━━━━━━━━━━━━━━━━━╋

? ? ?簡單網絡管理協議（SNMP），由一組網絡管理的標準組成，包含一個應用層協議（application layer protocol）、數據庫模型（database schema）和一組資源對象。該協議能夠支持網絡管理系統，用以監測連接到網絡上的設備是否有任何引起管理上關注的情況。該協議是互聯網工程工作小組（IETF，Internet Engineering Task Force）定義的internet協議簇的一部分。SNMP的目標是管理互聯網Internet上眾多廠家生產的軟硬件平臺，因此SNMP受Internet標準網絡管理框架的影響也很大。SNMP已經出到第三個版本的協議，其功能較以前已經大大地加強和改進了。

root@kali:~# onesixtyone

onesixtyone 0.3.2 [options] <host> <community>

? -c <communityfile> file with community names to try

? -i <inputfile>? ? ?file with target hosts

? -o <outputfile>? ? output log

? -d? ? ? ? ? ? ? ? ?debug mode, use twice for more information

? -w n? ? ? ? ? ? ? ?wait n milliseconds (1/1000 of a second) between sending packets (default 10)

? -q? ? ? ? ? ? ? ? ?quiet mode, do not print log to stdout, use with -l

examples: ./s -c dict.txt 192.168.4.1 public

? ? ? ? ? ./s -c dict.txt -i hosts -o my.log -w 100

root@kali:~# onesixtyone 192.168.1.133 pulic

Scanning 1 hosts, 1 communities

192.168.1.133 [public] Hardware: x86 Family 6 Model 42 Steping 7 AT/AT COMPATIBLE - Software: Windows 2000 Version 5.1(Bulid 2600 Uniprocessor Free)

root@kali:~# dpkg -L onesixtyone

/usr

/usr/bin

/usr/bin/onesixtyone

/usr/share

/usr/share/man

/usr/share/man/man1

/usr/share/man/man1/onesixtyone.1.gz

/usr/share/doc

/usr/share/doc/onesixtyone

/usr/share/doc/onesixtyone/copyright

/usr/share/doc/onesixtyone/changelog.gz

/usr/share/doc/onesixtyone/dict.txt

/usr/share/doc/onesixtyone/README

/usr/share/doc/onesixtyone/changelog.Debian.gz

root@kali:~# onesixtyone -c /usr/share/doc/onesixtyone/dict.txt 192.168.1.133 -o my.log -w 100

Logging to file my.log

Scanning 1 hosts, 49 communities

root@kali:~# nmap -sU -p161 192.168.1.134

Starting Nmap 6.49BETA5 ( https://nmap.org ) at 2015-10-06 00:32 CST

Note is up(0.00105 latency).

PORT? ? STATE? SERVICE

161/udp closed snmp

MAC Address: 08:00:27:Bo:3A:76 (Cadmus Computer Systems)

Nmap done: 1 IP address (0 hosts up) scanned in 0.55 seconds

╋━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╋

┃SNMP掃描? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ┃

┃snmpwalk 192.168.20.199 -c public -v 2c? ? ? ? ? ? ? ? ? ?┃

┃用戶? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ┃

┃? ? snmpwalk -c public -v 2c 1.1.1.1 1.3.6.1.4.1.77.1.2.25┃

┃snmpcheck -t 192.168.20.199? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?┃

┃snmpcheck? -t 192.168.20.199 -c private -v 2? ? ? ? ? ? ? ┃

┃snmpcheck? -t 192.168.20.199 -w? ? ? ? ? ? ? ? ? ? ? ? ? ?┃

╋━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╋

root@kali:~# snmpwalk 192.168.1.133 -c public -v 2c

root@kali:~# snmpwalk -c public -v 2c 192.168.1.133 1.3.6.1.4.1.77.1.2.25

root@kali:~# snmpwalk -c public -v 2c 192.168.1.133 1.3.6.1.2.1.25.6.3.1.2

root@kali:~# snmpcheck -h

Usage:? snmpcheck [-x] [-n|y] [-h] [-H] [-V NUM] [-L] [-f] [[-a] HOSTS]?

? -h Display this message.

? -a check error log file AND hosts specified on command line.

? -p Don't try and ping-echo the host first

? -f Only check for things I can fix

? HOSTS check these hosts for problems.

X Options:

? -x forces ascii base if $DISPLAY set (instead of tk).

? -H start in hidden mode.? (hides user interface)

? -V NUM sets the initial verbosity level of the command log (def: 1)

? -L Show the log window at startup

? -d Don't start by checking anything.? Just bring up the interface.

Ascii Options:

? -n Don't ever try and fix the problems found.? Just list.

? -y Always fix problems found.

root@kali:~# snmpcheck -t 192.168.1.133

轉載于:https://blog.51cto.com/11672938/1965387

總結

以上是生活随笔為你收集整理的【安全牛学习笔记】操作系统识别的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。

上一篇： xslt的简单使用[xml--html]
下一篇： Hyper-V 2016 系列教程26

windows

​【安全牛学习笔记】操作系统识别

總結

【安全牛学习笔记】操作系统识别