From: Aaron Turner <synfinatic@...>
Date: 2009-09-17T05:25:14+09:00
Subject: Re: OS Fingerprinting with Ruby

On Wed, Sep 16, 2009 at 12:00 PM, Joe Martin
<joseph.w.martin.ctr@navy.mil> wrote:
> I'm working my way into learning some basic socket programming.  I would
> like to incorporate some sort of nmap-like functionality, namely, OS
> fingerprinting.  Is this possible to do without relying on the actual
> nmap program?  Is there a way to read TCP/IP stack fingerprints and
> determine OS information in Ruby?

I'm not sure I would categorize OS fingerprinting as "basic socket
programming".  For that you need raw socket access (PF_PACKET under
Linux or BPF under OSX/*BSD).  And to make it work you need to create
a database of tests and how different OS's respond.  It's a *lot* of
work.

Anyways, yes it could be done in Ruby... although I don't recall off
the top of my head if Ruby supports PF_PACKET/BPF, but you could
always use the Ruby/C bindings for libpcap for raw frame injection &
reading responses.


-- 
Aaron Turner
http://synfin.net/
http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety.
    -- Benjamin Franklin