RE: Determining Operating System or Hardware via the Internet

[Scott Klement <klemscot@xxxxxxxxxxxx>]

Hi Shannon,

> Thanks for the responses.  I wasn't clear in what I was trying to do.  I
> would like to know if there is some way that I can tell what OS or hardware
> a website is running on if all I know is the URL or the IP address.  Maybe a
> command like TRACERT or PING or something?  Or a port scanner possibly?

Most of the time people try to make sure you CAN'T find out what OS or
platform they're running!!  Almost all published security holes rely on
you running a particular operating system-- therefore the very first
thing a hacker will do is try to detect what operating system and platform
you're running.  Once they've determined that, they can see what the known
security holes are for that operating system and look for one that is
exploitable on your system.

You might try something like Nmap or Queso (if Queso is still around??
it's homepage appears to be gone...)
More about Nmap is here: http://www.insecure.org/nmap/

They use a technique known as "TCP/IP fingerprinting" which relies on
quirks in the OS to determine which OS it's running.  For example, you
might send an invalid sequence of IP packets that make no sense. (such as
SYN, SYN+ACK, FIN, FIN+ACK, SYN+FIN, PSH, SYN+XXX+YYY where XXX and YYY
are unused flags)   Since the standards don't define what should be done
in response, different OSes do different things.   By using a table of
which OSes give which types of responses, they try to detect what the OS
must be.

If you click on the "OS Detection" link on the Nmap web site (above)
you'll get more details on why OS detection is important for security, and
how it works, etc.

Naturally, a well designed firewall will prevent this sort of thing.  And
NAT may very well change the behavior, so it's not completely reliable.


> I'm just trying to guess what some websites are using as a web server.  It's
> not that important, really.  It just occurred to me to wonder what places
> like Ebay and YAHOO were using for OS software and computing hardware.

I can tell you that Yahoo! runs FreeBSD.  Here's an article about it:
http://www.ictp.trieste.it/~cfonda/sudan/OSs/references/freeBSD/Yahoo_and_FreeBSD.html

Ebay runs Windows -- which was well known a few years ago when they had a
lot of problems with the systems going down and having to be restored from
backups :)  Nowadays they've enlisted IBM's help in making it stay up.
http://pages.ebay.com/ebay_IBM.html

Also, the server-string reported by the HTTP servers on the large sites
may give away what operating system they're running.  Netcraft.com allows
you to look this sort of thing up.  Especially for the large sites.
http://www.netcraft.com/whats