Fingerprinting is a technique of security auditing tool. Each service extracts some unique features from the packets sent by the client and server during a particular connection or transaction.
Each piece of information is known as one feature. Users can use this technique to identify the service running on the remote machine behind an application layer gateway/firewall by capturing specific responses from the firewall.
In other words, fingerprinting is a technique of identifying a service or application on the network. For example, some IP addresses belong to a particular country, but you can’t know which one precisely because it is hidden behind several proxies, firewalls, and NAT devices. However, by using some unique applications for fingerprinting services, we can figure out its real identity.
Features of Fingerprinting In Network Security
The following are the significant features of Fingerprinting:
- It can be used to identify which protocol is in use between client and server machines.
- The web application or system for fingerprinting can also extract OS details like Windows or Linux.
- Moreover, it extracts the exact version of the software, such as Apache and IIS.
- It can also identify the application installed on a particular website or system, for instance, WordPress or Joomla.
- Apart from that, it extracts the exact modules of the application like PHP, ASP, etc.
- Fingerprinting applications can find out proxy and VPN software’s details if you install it on the target machine.
- It can also reveal whether a firewall is present in between the application layer gateway or not.
- Sometimes, it extracts the name of the user account and its privileges, such as administrator or guest, which is very useful for social engineering attacks.
- Fingerprinting applications can find out the server’s exact location, including country, state, city, or ISP’s name.
- Some applications for fingerprinting include a keylogger to trace out the passwords typed by users on the target machine if they are using weak passwords.
Benefits of Fingerprinting In Network Security
- For security auditing purposes, fingerprinting can identify the OS or services running on target machines.
- Identifying OS behind NAT devices is most useful for penetration testers because they can exploit OS vulnerability after this information.
- To determine users’ location, free online IP geolocation tools can find users’ locations.
- Fingerprinting applications can be used for tasks like surveillance and target analysis because they provide us details about target machines such as operating systems, software versions, etc.
- To dump the RAM contents of the target machine in penetration testing, we can install a keylogger included in most fingerprinting applications.
10 Fingerprinting Techniques
1. Port Scanning
It is the most common technique to find open ports on target machines because certain services run on specific ports only.
2. Vulnerability Scanning
You can use this technique to find out whether certain services or applications are vulnerable to any known exploits or not. By using this method, we can quickly figure out the vulnerability of target machines.
3. Banner Grabbing
It is also known as Server-Side Fingerprinting, by which information about server software is obtained by sending some specific requests to it.
4. Operating System Fingerprinting
It uses various techniques to get the OS details of target machines such as TTL, Window size, options in TCP packets, etc.
Web Application Fingerprinting: This technique utilizes features included in HTTP requests and responses sent from client to web server to identify web server, for instance, Apache or IIS.
5. Network Fingerprinting
This technique uses features like TTL value to find out whether the target can directly connect to the internet (public IP) or behind a proxy (private IP).
6. User Agent Detection
It is also known as Client-Side Fingerprinting because it identifies the web browser and its version installed on the client machine.
7. Web Service Fingerprinting
This technique extracts HTTP headers to determine whether a particular service runs on the target machine, such as botnet C&C, SSH, etc.
8. Whitelist/Blacklist Verification
This technique uses data mining algorithms to get suspicious requests and verify whether those requests are malicious or not.
9. Keystroke Logging
Users use this technique to find out passwords by recording every keystroke they type on target machines.
10. OS Detection
Sometimes we need to know about the operating system installed on machines to perform specific tasks accordingly.
Tools Used For Fingerprinting
- HOIC (High Orbit Ion Cannon)
- Nmap
- p0f
- Xprobe2/Fyodor’s Nmap Scripts
- A map
- SMAC
- Aaron
- Ettercap
- WinPooch/Wifi-Pumpkin
- Mdk3(Mitmproxy)
- Skyjack/Toolkit (JDWP)
Conclusion
Fingerprinting is a critical phase of ethical hacking because it helps the penetration testers get more information about target machines such as OS type, software version, or vulnerabilities.
We can conclude that people use Application Fingerprinting to identify different network devices and applications. Security auditors use fingerprinting for security purposes; attackers use it for performing social engineering attacks like Man in The Middle (MITM) Attacks, etc.
