Solved

Disguise a Server

Posted on 2007-04-06
7
167 Views
Last Modified: 2011-04-14
Does anyone know how to disguise your box to look like a Windows Server to nmap (instead of a Linux Server)?
0
Comment
Question by:OutOfAmmo
7 Comments
 
LVL 11

Expert Comment

by:kblack05
Comment Utility
Yeah you can simply use SINFP to change the OS reporting for the TCP Stack:

http://www.gomor.org/cgi-bin/sinfp.pl?mode=view;page=sinfp_description
0
 
LVL 57

Expert Comment

by:giltjr
Comment Utility
I'm confused.  SINFP seems to be another program like nmap that tries and detects what OS a computer is running.

I don't think you want to change your Linux box to look like a Windows box.  What software does to try and finger print a OS is to look at how the IP stack responds to specific situations.  In order to make your Linux box look like it Windows you would need to change the IP stack code to respond as if it were Windows.  Which means changing the IP source code.
0
 
LVL 24

Expert Comment

by:slyong
Comment Utility
I agree with what giltjr suggest that you "do not" want to make your Linux boxes look like a Windows boxes and it is probably no way to do that.  There are however, a few ways that I knew from an old article (http://insecure.org/nmap/misc/defeat-nmap-osdetect.html) that you can foil nmap OS fingerprinting.  They are written at the time of 2.2 / 2.4 series of kernels.  I am not sure if there exists anything for kernel 2.6.
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 11

Expert Comment

by:kblack05
Comment Utility
As posted in your other comment, you tune the OS area of the TCP stack.

http://www.zog.net/Docs/nmap.html
0
 
LVL 11

Accepted Solution

by:
kblack05 earned 250 total points
Comment Utility
This modifies the TCP OS Fingerprint area of the TCP stack, and is not harmful. Many people do this, though it is only going to foil a less experienced attacker. If someone scans your box and it shows up as an atari 2600, it might just urge them to probe deeper, and will not change the vulnerability of the box. You should focus more on security and less on disquise. Here is a great guide to get started:

http://www.ecst.csuchico.edu/~dranch/LINUX/TrinityOS/cHTML/TrinityOS-c.html
0
 

Author Comment

by:OutOfAmmo
Comment Utility
Thanks for all of the input.  I posted this question for a friend who was given this assignment by her instructor in a security class with very little explanation, but it sounds as if you are all on the right track with your suggestions.  I will pass this info along to her and try to close out this question or post additional information ASAP.
0
 

Author Comment

by:OutOfAmmo
Comment Utility
My apologies for failing to get back on this.  My friend dropped the issue because her instructor didn't seem to even know the answer and wasn't sure what the results were supposed to be.  Based on what I could glean from the limited information, I think everyone was basically on the correct path.  Because kblack05 posted the most thorough information, I have accepted that as the solution.
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

If your site has a few sections that need to be secure when data is transmitted between the server and local computer, such as a /order/ section for ordering or /customer/ which contains customer data, etc it would of course be recommended to secure…
It is possible to boost certain documents at query time in Solr. Query time boosting can be a powerful resource for finding the most relevant and "best" content. Of course the more information you index, the more fields you will be able to use for y…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now