Xprobe2 - active OS fingerprinting tool

Xprobe2 is use for perform fingerprinting on remote target.

Download Xprobe2

Installation(Bactrack and kali Linux has built in)

You will need libpcap:

$ sudo apt-get install libpcap0.8-dev

You will also need g++-4.1

$ sudo apt-get install g++-4.1

Install Xprobe2

$ wget http://downloads.sourceforge.net/project/xprobe/xprobe2/Xprobe2%200.3/xprobe2-0.3.tar.gz
$ tar xzvf xprobe2-0.3.tar.gz
$ cd xprobe2-0.3/
$ ./configure CC=gcc-4.1 CXX=g++-4.1
$ make
$ sudo make install

Options

-v
Be verbose

-r
Show route to target(traceroute-like output)

-p <proto:portnum:state>
Specify portnumber (1-65535), protocol (tcp|udp) and state (closed|open).
Example: tcp:25:open, UDP:55:CLOSED

-c <configfile>
Specify config file to use.

-h
Print this help.

-o <fname>
Use logfile to log everything.

-t <time_sec>
Set receive timeout to receive_timeout in seconds
(default: 10 seconds)

-s <send_delay>
Set packsending delay (milseconds).

-d <debuglv>
Specify debugging level.

-D <modnum>
Disable module number <modnum>.

-M <modnum>
Enable module number <modnum>.

-L
Display modules.

-m <numofmatches>
Specify number of matches to print.

-T <portspec>
Enable TCP portscan for specified port(s).
Example: -T21-23,25,53

-U <portspec>
Enable UDP portscan for specified port(s).

-f
Force fixed round-trip time (-t opt).

-F
Generate signature (use -o to save to a file).

-X
Generate XML output and save it to logfile specified with -o.

-B
Options forces TCP handshake module to try to guess open TCP port

-A
Perform analysis of sample packets gathered during portscan in order to detect suspicious traffic (i.e. transparent proxies, firewalls/NIDSs resetting connections).
Use with -T.