{ "info": { "author": "Jaime Sanchez (@segofensiva)", "author_email": "jsanchez@seguridadofensiva.com", "bugtrack_url": null, "classifiers": [ "Development Status :: 4 - Beta", "Environment :: Console", "License :: OSI Approved :: GNU General Public License v3 (GPLv3)", "Operating System :: POSIX :: Linux", "Programming Language :: Python", "Topic :: Security", "Topic :: System :: Networking" ], "description": "

\n\n

\n
\n\n# OSfooler-NG\n [![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)\n![Version: 1.0](https://img.shields.io/badge/version-1.0-blue.svg)\n[![Maintenance](https://img.shields.io/badge/Maintained%3F-yes-blue.svg)](https://GitHub.com/segofensiva/OSfooler-ng/graphs/commit-activity)\n\nAn outsider has the capability to discover general information, such as which operating system a host is running, by searching for default stack parameters, ambiguities in IETF RFCs or non-compliant TCP/IP implementations in responses to malformed requests. By pinpointing the exact OS of a host, an attacker can launch an educated and precise attack against a target machine.\n\nThere are lot of reasons to hide your OS to the entire world:\n * Revealing your OS makes things easier to find and successfully run an exploit against any of your devices.\n * Having and unpatched or antique OS version is not very convenient for your company prestige. Imagine that your company is a bank and some users notice that you are running an unpatched box. They won't trust you any longer! In addition, these kind of 'bad' news are always sent to the public opinion.\n * Knowing your OS can also become more dangerous, because people can guess which applications are you running in that OS (data inference). For example if your system is a MS Windows, and you are running a database, it's highly likely that you are running MS-SQL.\n * It could be convenient for other software companies, to offer you a new OS environment (because they know which you are running).\n * And finally, privacy; nobody needs to know the systems you've got running.\n\nOSfooler was presented at Blackhat Arsenal 2013. It was built on NFQUEUE, an iptables/ip6tables target which delegate the decision on packets to a userspace. It transparently intercepted all traffic that your box was sending in order to camouflage and modify in real time the flags in TCP/IP packets that discover your system.\n\nOSfooler-NG has been complete rewriten from the ground up, being highly portable, more efficient and combining all known techniques to detect and defeat at the same time:\n * Active remote OS fingerprinting: like Nmap\n * Passive remote OS fingeprinting: like p0f v2\n * Commercial engines like Sourcefire\u2019s FireSiGHT OS fingerprinting\n\nSome additional features are:\n * No need for kernel modification or patches\n * Simple user interface and several logging features\n * Transparent for users, internal process and services\n * Detecting and defeating mode: active, passive & combined\n * Will emulate any OS\n * Capable of handling updated nmap and p0f v2 fingerprint database\n * Undetectable for the attacker\n\n# Install\nTo get the latest versions, with bugfixes and new features, but maybe not as stable, use the the Github repository:\n```\n$ git clone https://github.com/segofensiva/OSfooler-ng.git\n```\n\nYou need to install python-nfqueue (v0.5-1build2) linux package. Download from [Ubuntu Packages](https://packages.ubuntu.com/xenial/python-nfqueue):\n```\n$ wget http://mirrors.kernel.org/ubuntu/pool/universe/n/nfqueue-bindings/python-nfqueue_0.5-1build2_amd64.deb\n$ dpkg -i python-nfqueue_0.5-1build2_amd64.deb\n```\n\nInstall OSfooler-ng in the standard way:\n```\n$ sudo python setup.py install\n```\n\n# Usage\n## Active Fingerprinting: nmap\nTo get the full list of OS to emulate, just use the flag '-n':\n```\n$ osfooler-ng.py -n\n [+] Please, select nmap OS to emulate\n + \"2N Helios IP VoIP doorbell\"\n + \"2Wire BT2700HG-V ADSL modem\"\n + \"2Wire 1701HG wireless ADSL modem\"\n [...]\n + \"ZyXEL Prestige 660HW-61 ADSL router (ZyNOS 3.40)\"\n + \"ZyXEL Prestige 660HW-D1 wireless ADSL router\"\n + \"ZyXEL ZyWALL 2 Plus firewall\"\n```\n\nTo emulate an specific OS, just use the flag '-o' with the OS you want to emulate:\n```\n$ osfooler-ng.py -m \"Sony Ericsson W705 or W715 Walkman mobile phone\"\n [+] Mutating to nmap:\n Fingerprint Sony Ericsson W705 or W715 Walkman mobile phone\n Class Sony Ericsson | embedded || phone\n CPE cpe:/h:sonyericsson:w705\n CPE cpe:/h:sonyericsson:w715\n SEQ(CI=RD%II=I)\n OPS(R=N)\n WIN(R=N)\n ECN(R=N)\n T1(R=N)\n T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)\n T3(R=N)\n T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)\n T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)\n T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)\n T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)\n U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)\n IE(DFI=N%T=3B-45%TG=40%CD=S)\n [+] Activating queues\n [->] Process-1: nmap packet processor\n```\n\n## Passive Fingerprinting: p0f v2\nTo get the full list of OS to emulate, just use the flag '-l':\n```\n$ osfooler-ng.py -p \nPlease, select p0f OS Genre and Details\n OS Genre=\"AIX\" Details=\"4.3\"\n OS Genre=\"AIX\" Details=\"4.3.2 and earlier\"\n OS Genre=\"AIX\" Details=\"4.3.3-5.2 (1)\"\n [...]\n OS Genre=\"-*NMAP\" Details=\"OS detection probe w/flags (3)\"\n OS Genre=\"-*NMAP\" Details=\"OS detection probe w/flags (4)\"\n OS Genre=\"-*NAST\" Details=\"syn scan\"\n```\n\nTo emulate any p0f OS, just use the flag '-o' with the OS Genre. This will choose the main OS and custom version will be randomly loaded when a SYN packet is detected. For example:\n```\n$ osfooler-ng.py -o \"PalmOS\"\n [+] Mutating to p0f:\n WWW:S9|TTL:255|D:0|SS:44|OOO:M536|QQ:.|OS:PalmOS|DETAILS:Tungsten T3/C\n WWW:S5|TTL:255|D:0|SS:44|OOO:M536|QQ:.|OS:PalmOS|DETAILS:3/4\n WWW:S4|TTL:255|D:0|SS:44|OOO:M536|QQ:.|OS:PalmOS|DETAILS:3.5\n WWW:2948|TTL:255|D:0|SS:44|OOO:M536|QQ:.|OS:PalmOS|DETAILS:3.5.3 (Handera)\n WWW:S29|TTL:255|D:0|SS:44|OOO:M536|QQ:.|OS:PalmOS|DETAILS:5.0\n WWW:16384|TTL:255|D:0|SS:44|OOO:M1398|QQ:.|OS:PalmOS|DETAILS:5.2 (Clie)\n WWW:S14|TTL:255|D:0|SS:44|OOO:M1350|QQ:.|OS:PalmOS|DETAILS:5.2.1 (Treo)\n WWW:16384|TTL:255|D:0|SS:44|OOO:M1400|QQ:.|OS:PalmOS|DETAILS:5.2 (Sony)\n [+] Activating queues\n [->] Process-1: p0f packet processor\n```\n \n You can also emulate the full p0f OS, using '-' with the OS Genre and '-d' with custom details:\n ```\n $ osfooler-ng.py -o \"Windows\" -d \"XP bare-bone\"\n [+] Mutating to p0f:\n WWW:65520|TTL:128|D:1|SS:48|OOO:M*,N,N,S|QQ:.|OS:Windows|DETAILS:XP bare-bone\n [+] Activating queues\n [->] Process-1: p0f packet processor\n ```\n\n## Active and Passive Fingerprinting: nmap & p0f\nOSfooler-ng is also capable os emulating both OS to defeat nmap and p0f. Just combine the parameters above:\n```\n$ osfooler-ng -m \"Microsoft Windows 2000 SP4\" -o \"Windows\" -d \"2000 SP4\"\n [+] Mutating to nmap:\n Fingerprint Microsoft Windows 2000 SP4\n Class Microsoft | Windows | 2000 | general purpose\n CPE cpe:/o:microsoft:windows_2000::sp4\n SEQ(SP=7C-86%GCD=1-6%ISR=95-9F%TI=I%II=I%SS=O|S%TS=0)\n OPS(O1=NNT11|M5B4NW0NNT00NNS%O2=NNT11|M5B4NW0NNT00NNS%O3=NNT11|M5B4NW0NNT00%O4=NNT11|M5B4NW0NNT00NNS%O5=NNT11|M5B4NW0NNT00NNS%O6=NNT11|M5B4NNT00NNS)\n WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)\n ECN(R=Y%DF=N%T=7B-85%TG=80%W=0%O=%CC=N%Q=U)\n T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=O|S+%F=A|AS%RD=0%Q=|U)\n T2(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=U)\n T3(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=U)\n T4(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=U)\n T5(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=U)\n T6(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=U)\n T7(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=U)\n U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)\n IE(DFI=S%T=7B-85%TG=80%CD=Z)\n [+] Mutating to p0f:\n WWW:40320|TTL:128|D:1|SS:48|OOO:M*,N,N,S|QQ:.|OS:Windows|DETAILS:2000 SP4\n [+] Activating queues\n [->] Process-1: nmap packet processor\n [->] Process-2: p0f packet processor\n```\n\n## Searching for Operating Systems\nYou can search inside nmap/p0f database for a specific OS, instead of getting the whole list. Just use the flag '-s' and enter the keyword you want to search for (case insensitive). You'll get any match found, and if it belongs to nmap or p0f databases:\n```\n$ osfooler-ng.py -s playstation\n [+] Searching databases for: 'playstation'\n [nmap] \"Sony Playstation 4 or FreeBSD 10.2-RELEASE\"\n [nmap] \"Sony PlayStation 2 game console test kit 2.2.1\"\n [nmap] \"Sony PlayStation 3 game console\"\n [nmap] \"Sony PlayStation 3 game console test kit\"\n [nmap] \"Sony PlayStation 2 game console\"\n [p0f] OS: \"Sony\" DETAILS: \"Playstation 2 (SOCOM?)\"\n```\n\n## Update nmap database\nUse the flag '-u' to check if there's a new version of nmap's database avaiable and to download it\n```\n$ osfooler-ng.py -u\n [+] Checking nmap database... latest!\n```\n\n## Custom flags\nThere are other interesting flags:\n * '-v': Show info about every modified packet\n * '-i ': Choose network interface (eth0 by default)\n * '-V': Show OSfooler-ng banner and current version installed\n\n# Authors\n* **[Jaime S\u00e1nchez](https://www.seguridadofensiva.com) ([@segofensiva)](https://twitter.com/segofensiva)**\n\n# License\n\nThis project is licensed under the The **GNU General Public License v3.0** - see the [LICENSE.md](LICENSE.md) file for details\n\n# Acknowledgments\n\n* [Defcon China](https://defcon.org/html/dc-china-1/dc-cn-1-index.html), for leting me show this tool on [Demo Labs](https://defcon.org/html/dc-china-1/dc-cn-1-demolabs.html#segofensiva)\n* All those people who have worked and released software on OS fingerprinting (attack and defense), specially [nmap](https://nmap.org/) & [p0f](lcamtuf.coredump.cx/), but also Xprobe, IP Personality etc.\n* OSfooler-ng makes use of the [Scapy Project](https://scapy.net/) and [The netfilter.org \"libnetfilter_queue\" project](https://netfilter.org/projects/libnetfilter_queue/)", "description_content_type": "text/markdown", "docs_url": null, "download_url": "", "downloads": { "last_day": -1, "last_month": -1, "last_week": -1 }, "home_page": "https://github.com/segofensiva/OSfooler-ng", "keywords": "", "license": "", "maintainer": "", "maintainer_email": "", "name": "OSfooler-ng", "package_url": "https://pypi.org/project/OSfooler-ng/", "platform": "", "project_url": "https://pypi.org/project/OSfooler-ng/", "project_urls": { "Homepage": "https://github.com/segofensiva/OSfooler-ng" }, "release_url": "https://pypi.org/project/OSfooler-ng/1.0a0/", "requires_dist": null, "requires_python": "", "summary": "OSfooler-ng prevents remote OS active/passive fingerprinting by tools like nmap or p0f", "version": "1.0a0" }, "last_serial": 5318681, "releases": { "1.0a0": [ { "comment_text": "", "digests": { "md5": "0df0c8ada1fe7fb333612ad8e122c893", "sha256": "1f606043441a7b27b15166984bd2a32a290125f4bc5b2421de84e4dead0b289c" }, "downloads": -1, "filename": "OSfooler-ng-1.0a0.tar.gz", "has_sig": false, "md5_digest": "0df0c8ada1fe7fb333612ad8e122c893", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 589096, "upload_time": "2019-05-26T12:02:19", "url": "https://files.pythonhosted.org/packages/65/54/5e503194a77883108b5097a1e581098eaff98081b597403bc079be1af5eb/OSfooler-ng-1.0a0.tar.gz" } ] }, "urls": [ { "comment_text": "", "digests": { "md5": "0df0c8ada1fe7fb333612ad8e122c893", "sha256": "1f606043441a7b27b15166984bd2a32a290125f4bc5b2421de84e4dead0b289c" }, "downloads": -1, "filename": "OSfooler-ng-1.0a0.tar.gz", "has_sig": false, "md5_digest": "0df0c8ada1fe7fb333612ad8e122c893", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 589096, "upload_time": "2019-05-26T12:02:19", "url": "https://files.pythonhosted.org/packages/65/54/5e503194a77883108b5097a1e581098eaff98081b597403bc079be1af5eb/OSfooler-ng-1.0a0.tar.gz" } ] }