Introduction
Welcome to the Operating System Fingerprinting lab.
Operating system fingerprinting is a critical reconnaissance technique used by security professionals and attackers alike to determine the operating system running on a remote target. By sending specific, sometimes malformed, TCP and UDP packets to a target and analyzing the subtle differences in how the target's TCP/IP stack responds (such as Time-To-Live values, window sizes, and flag combinations), tools like Nmap can accurately guess the underlying operating system.
This is an inference technique, not direct truth. Nmap is comparing observed network behavior against a fingerprint database. The result can be very useful, but it should be treated as an educated estimate that may be affected by firewalls, proxies, or unusual stacks.
In this lab, you will learn how to leverage Nmap's powerful OS fingerprinting capabilities to identify remote systems and combine these techniques with version detection for comprehensive network profiling.
Enable OS Fingerprinting
In this step, we will learn the basics of operating system fingerprinting using Nmap. Operating system fingerprinting is a technique used to determine the operating system running on a remote target. Nmap achieves this by sending a series of carefully crafted TCP and UDP packets to the target and analyzing the responses. Since different operating systems implement the TCP/IP stack slightly differently, Nmap can compare these responses against its extensive database to find a match.
This works because network stacks are implementations written by humans, and implementations differ in many subtle defaults. Fingerprinting turns those differences into clues.
To enable OS fingerprinting in Nmap, we use the -O flag. It is important to note that crafting raw packets requires administrative privileges, so we must run this command using sudo.
Let us run an OS fingerprinting scan against our local machine (localhost) and save the output to a file named os_scan.txt in our project directory.
sudo nmap -O -p 22,80 localhost > /home/labex/project/os_scan.txt
After the scan completes, you can view the results using the cat command.
cat /home/labex/project/os_scan.txt
You will see an output similar to the following. Look for the lines starting with "Device type", "Running", and "OS details".
Starting Nmap 7.80 ( https://nmap.org ) at 2026-03-09 14:53 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000020s latency).
Other addresses for localhost (not scanned): ::1
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.32
OS details: Linux 2.6.32
Network Distance: 0 hops
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.56 seconds
The output reveals that the target is running a Linux kernel, which matches our LabEx environment.
Analyze OS Guesses
In this step, we will explore how Nmap handles uncertainty during OS fingerprinting. Sometimes, a target might have a firewall that drops certain packets, or it might be running an obscure or highly customized operating system. In these cases, Nmap might not find a perfect match in its database.
When Nmap cannot determine the exact operating system, it can provide a list of guesses along with a confidence percentage. We can force Nmap to guess more aggressively by using the --osscan-guess flag (which is also equivalent to --fuzzy). This tells Nmap to print OS matches even if they are not near-perfect.
This reminds us that reconnaissance output often contains uncertainty. Good analysts record that uncertainty instead of pretending every detection is exact.
Let us run another scan against localhost, this time enabling aggressive OS guessing, and save the results to a file named guess_scan.txt.
sudo nmap -O --osscan-guess -p 22,80 localhost > /home/labex/project/guess_scan.txt
Now, view the contents of the new file.
cat /home/labex/project/guess_scan.txt
The output will look similar to the previous step, but if the target were more obscure, you would see a comma-separated list of OS guesses with percentages, like Aggressive OS guesses: Linux 5.0 (96%), Linux 4.15 (95%).
Starting Nmap 7.80 ( https://nmap.org ) at 2026-03-09 14:54 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000020s latency).
...
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.32
OS details: Linux 2.6.32
...
Even on a standard system, using --osscan-guess is a valuable technique when dealing with hardened targets that try to obscure their TCP/IP stack behavior.
Combine OS and Version Detection (-A)
In this step, we will combine OS detection with other powerful Nmap features using the -A flag. The -A flag stands for "Aggressive scan options".
When you use the -A flag, Nmap automatically enables several advanced features at once:
- OS detection (
-O) - Version detection (
-sV), which probes open ports to determine service and application versions - Script scanning (
-sC), which runs a default set of Nmap Scripting Engine (NSE) scripts - Traceroute (
--traceroute), which determines the network path to the target
This combined approach provides a comprehensive profile of the target system, making it a favorite among security professionals for initial reconnaissance.
Let us perform an aggressive scan against localhost and save the output to aggressive_scan.txt. This scan might take slightly longer because it is performing many more checks.
sudo nmap -A -p 22,80 localhost > /home/labex/project/aggressive_scan.txt
Once the scan is complete, inspect the results.
cat /home/labex/project/aggressive_scan.txt
You will notice a much richer output. Alongside the OS details, you will now see the exact versions of the services running on the open ports (like OpenSSH and nginx), as well as additional information gathered by the default scripts.
Starting Nmap 7.80 ( https://nmap.org ) at 2026-03-09 14:54 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000019s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.32
OS details: Linux 2.6.32
...
By combining these techniques, you can gather a wealth of information about a target system with a single command.
Summary
Congratulations! You have successfully completed the Operating System Fingerprinting lab.
In this lab, you learned how to:
- Use Nmap's
-Oflag to perform remote operating system fingerprinting by analyzing TCP/IP stack responses. - Apply the
--osscan-guessflag to force Nmap to provide probabilistic guesses when the target OS is not perfectly matched. - Utilize the
-Aflag to combine OS detection with service version detection, script scanning, and traceroute for comprehensive target profiling.
These skills are fundamental for network reconnaissance and vulnerability assessment, allowing security professionals to understand the environment they are analyzing and tailor their security measures accordingly.
