[Last Call] Learn about multicloud storage options and how to improve your company's cloud strategy. Register Now

x
?
Solved

Disguise a Server

Posted on 2007-04-06
7
Medium Priority
?
185 Views
Last Modified: 2011-04-14
Does anyone know how to disguise your box to look like a Windows Server to nmap (instead of a Linux Server)?
0
Comment
Question by:OutOfAmmo
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 11

Expert Comment

by:kblack05
ID: 18879394
Yeah you can simply use SINFP to change the OS reporting for the TCP Stack:

http://www.gomor.org/cgi-bin/sinfp.pl?mode=view;page=sinfp_description
0
 
LVL 57

Expert Comment

by:giltjr
ID: 18879618
I'm confused.  SINFP seems to be another program like nmap that tries and detects what OS a computer is running.

I don't think you want to change your Linux box to look like a Windows box.  What software does to try and finger print a OS is to look at how the IP stack responds to specific situations.  In order to make your Linux box look like it Windows you would need to change the IP stack code to respond as if it were Windows.  Which means changing the IP source code.
0
 
LVL 24

Expert Comment

by:slyong
ID: 18881351
I agree with what giltjr suggest that you "do not" want to make your Linux boxes look like a Windows boxes and it is probably no way to do that.  There are however, a few ways that I knew from an old article (http://insecure.org/nmap/misc/defeat-nmap-osdetect.html) that you can foil nmap OS fingerprinting.  They are written at the time of 2.2 / 2.4 series of kernels.  I am not sure if there exists anything for kernel 2.6.
0
Q2 2017 - Latest Malware & Internet Attacks

WatchGuard’s Threat Lab is a group of dedicated threat researchers committed to helping you stay ahead of the bad guys by providing in-depth analysis of the top security threats to your network.  Check out our latest Quarterly Internet Security Report!

 
LVL 11

Expert Comment

by:kblack05
ID: 18883502
As posted in your other comment, you tune the OS area of the TCP stack.

http://www.zog.net/Docs/nmap.html
0
 
LVL 11

Accepted Solution

by:
kblack05 earned 1000 total points
ID: 18883515
This modifies the TCP OS Fingerprint area of the TCP stack, and is not harmful. Many people do this, though it is only going to foil a less experienced attacker. If someone scans your box and it shows up as an atari 2600, it might just urge them to probe deeper, and will not change the vulnerability of the box. You should focus more on security and less on disquise. Here is a great guide to get started:

http://www.ecst.csuchico.edu/~dranch/LINUX/TrinityOS/cHTML/TrinityOS-c.html
0
 

Author Comment

by:OutOfAmmo
ID: 18886624
Thanks for all of the input.  I posted this question for a friend who was given this assignment by her instructor in a security class with very little explanation, but it sounds as if you are all on the right track with your suggestions.  I will pass this info along to her and try to close out this question or post additional information ASAP.
0
 

Author Comment

by:OutOfAmmo
ID: 19010569
My apologies for failing to get back on this.  My friend dropped the issue because her instructor didn't seem to even know the answer and wasn't sure what the results were supposed to be.  Based on what I could glean from the limited information, I think everyone was basically on the correct path.  Because kblack05 posted the most thorough information, I have accepted that as the solution.
0

Featured Post

Veeam Disaster Recovery in Microsoft Azure

Veeam PN for Microsoft Azure is a FREE solution designed to simplify and automate the setup of a DR site in Microsoft Azure using lightweight software-defined networking. It reduces the complexity of VPN deployments and is designed for businesses of ALL sizes.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Have you ever been frustrated by having to click seven times in order to retrieve a small bit of information from the web, always the same seven clicks, scrolling down and down until you reach your target? When you know the benefits of the command l…
Introduction This article is intended for those who are new to PHP error handling (https://www.experts-exchange.com/articles/11769/And-by-the-way-I-am-New-to-PHP.html).  It addresses one of the most common problems that plague beginning PHP develop…
In this video you will find out how to export Office 365 mailboxes using the built in eDiscovery tool. Bear in mind that although this method might be useful in some cases, using PST files as Office 365 backup is troublesome in a long run (more on t…
This lesson discusses how to use a Mainform + Subforms in Microsoft Access to find and enter data for payments on orders. The sample data comes from a custom shop that builds and sells movable storage structures that are delivered to your property. …
Suggested Courses
Course of the Month12 days, 20 hours left to enroll

650 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question