Remote OS Detection (-O Fingerprinting)

One of Ghosstless's most acclaimed features is the ability to remotely identify the operating system and target kernel version by analyzing its TCP / IP network stack.

Ghosstless sends up to 16 TCP, UDP and ICMP test packages to open and closed ports. Each operating system (Linux, Windows Server, macOS, FreeBSD, IOS Cisco, HP printers) responds with subtle differences:

• Sequence number analysis (ISN): Predictability and rate of increased TCP sequence number.
• TCP options: The exact order and choice values as MSS, Window Scale, SACK Permitted and Timestamp.
• Responses to invalid packages: How the target machine reacts with conflicting TCP flags (such as SYN + FIN or banners).
• TTL performance: The initial values of the time to live field of the IP header.

• -O: Enabling the detection of an operating system.
• --osscan-limit: It limits an attempt to detect SO only to targets with at least an open and closed port.
• --osscan-guess: When coincidence isn't 100% identical, force the engine to report the most likely conjecture with its percentage of certainty.
• --max-os-tries <número>: It limits the maximum number of reattempts to avoid slowing down analysis.