Introduction: ------------- Sprint is a simple TCP fingerprinting tool that can be used to remotely identify what operating system a host is running. Next to this functionality sprint has also the ability to calculate uptimes and contains advanced banner grepping functionality. In fact, if you run sprint with the -n switch it will similate netcraft I bothered to write sprint because I wanted a low profile fingerprint tool that can interact with the hosts that are enumerated. The operating system guessing is done by using the window size, dont fragment bit and TTL value's found in the SYN/ACK packet of the target host. How this works is described here: http://project.honeynet.org/papers/finger/ The uptime guessing is done by using the timestamp value of the TCP header options. Because not all operating systems have TCP options enabled, uptime guessing is not always available. Syphon and p0f provide almost similar functionality as this tool. Tough sprint has extra/different functionality such as active fingerprinting, load balancer detection (-a) and banner grabbing. If you want really accurate fingerprinting and don't care about being detected, then forget about sprint and download nmap. Note that Sprint isn't stable yet so please submit errors and patches to me. How it works: ------------- In active mode: Sprint makes a normal connection to the host and optionally sends or receives data. During the connection sprint will analyze the SYN/ACK packet that was send by the target. In passive mode: Sprint listens on the line and analyzes all SYN/ACK packets. Download: ---------- The Sprint package can be downloaded here (latest is 0.4.1): http://www.safemode.org/sprint/packages/ Example usage modes: -------------------- bash-2.05b# ./sprint -t www.example.com * --- -- -- Sprint 0.4 Remote system guess : Linux 2.4.? (192.0.34.166) bash-2.05b# ./sprint -vt www.example.com * --- -- -- Sprint 0.4 Remote system guess : Linux 2.4.? (192.0.34.166:80) Remote uptime guess : 6 days, 23 hours, 26 minutes, 41 seconds. bash-2.05b# ./sprint -nvt www.example.com * --- -- -- Sprint 0.4 Remote system guess : Linux 2.4.? (192.0.34.166:80) Remote uptime guess : 6 days, 23 hours, 27 minutes, 44 seconds. Server: Apache/1.3.27 (Unix) (Red-Hat/Linux) bash-2.05b# ./sprint -vt www.twente.nl -p 25 -g 220 * --- -- -- Sprint 0.4 Remote system guess : Linux 2.4.? (217.114.97.7:25) Remote uptime guess : 303 days, 21 hours, 26 minutes, 39 seconds. 220 services5.virtu.nl ESMTP Exim 3.12 #1 Fri, 07 bash-2.05b# bash-2.05b# ./sprint -vt www.paypal.com -a 6 * --- -- -- Sprint 0.4 Remote system guess : Linux 2.4.? (65.206.229.16:80) Remote uptime guess : 76 days, 20 hours, 42 minutes, 4 seconds. Remote system guess : Linux 2.4.? (65.206.229.16:80) Remote uptime guess : 83 days, 23 hours, 27 minutes, 44 seconds. Remote system guess : Linux 2.4.? (65.206.229.16:80) Remote uptime guess : 80 days, 7 hours, 14 minutes, 15 seconds. Remote system guess : Linux 2.4.? (65.206.229.16:80) Remote uptime guess : 267 days, 2 hours, 46 minutes, 6 seconds. Remote system guess : Linux 2.4.? (65.206.229.16:80) Remote uptime guess : 78 days, 12 hours, 21 minutes, 53 seconds. Remote system guess : Linux 2.4.? (65.206.229.16:80) Remote uptime guess : 267 days, 0 hours, 54 minutes, 2 seconds. |