-2

I there a way to get information on which operating system a site is running?

I need to find sites whose server has Linux installed.

Is what I'm asking feasible through Google?

Thanks a lot

Improve this question

4 Answers 4

Reset to default
1

nmap -O can give you some information... but chances are that any major production website you'll hit these days will be behind a hardware or software load balancer, so that result may not be valid.

Can you give more detail or context in what you're trying to do?

Improve this answer
1
  • 1
    Beside i am quite sure running nmap on other networks apart from yours without permission, is an offence. At least it is, where I reside from.
    – Soham Chakraborty
    Dec 25, 2012 at 18:48
1

Well, there are couple of ways on finding this info.

If you want to find out specifically which version of flavor of Linux OS it is running, then you need to do a host scan using nmap with -O options, but host/port scan is something which anyone can detect and I don't think you would like to run a port scan on few machines of a data center.

The other way is to use the feature of default TTL of operating systems.

So, every OS have their own TTL, and when you ping them, they reply with their TTL values.

When you ping a machine, then you see an output like this

64 bytes from xxx.xxx.xxx.xxx: icmp_seq=0 ttl=48 time=396.306 ms
64 bytes from xxx.xxx.xxx.xxx: icmp_seq=1 ttl=48 time=324.736 ms

Just look at the TTL value. Over here it is 48. Now running a traceroute can easily tell you that there are 16 hops in between you and the server. Simply add both the values. This means that the server TTL is 64, which is the default TTL for most of the Linux machines.

You can check the default TTLs for different OS's over here.

So, you can simply write a small script, which can ping a server, check the TTL, and then traceroute to see the number of HOPS and then add up the values.

nmap method is something which will take time, but the information given will be precise in most of the cases, but there will be cases where nmap will be blocked and you won't be able to ping the OS

ping method will be real quick but the information will be a little bit not perfect. ping is normally open on most of the servers.

Hope this helped.

Improve this answer
2
  • Thanks a lot for your explanation.Perhaps I didn't ask my question correctly. I know that by using nmap -O I can roughly get information about the OS a site is running..also your method of inference works quite well..but my question is: without knowing of a site whose server is running on Linux how can I find one? i mean I cannot resort to a trial and error method it would be time consuming...thanks
    – g9999
    Dec 25, 2012 at 22:22
  • Ohhh ... not really have a good idea of that :(
    – Napster_X
    Dec 26, 2012 at 5:20
0

I know of a way that works and is easy but doesn't work always. The way is use the non existant page. So the website would return 404. If it was apache then in the footer (if the site ops haven't disabled) , it would show apache version and OS. If it was IIS then 404 would show a IIS-ish error message (Again if the site ops haven't disbaled it).

Improve this answer
0

Netcraft confirms it.

Or is that meme a /. thing only?

Netcraft has a tool on their website for your question.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .