Service and OS Fingerprinting
Use Nmap -sV and -O to identify running services and operating systems.
Service and OS Fingerprinting is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Fingerprinting Matters
Knowing the exact service version and operating system turns a list of open ports into an actionable target list. Version data maps directly to CVE numbers and exploit modules.
Service Version Detection with -sV
nmap -sV probes each open port with service-specific payloads and matches responses against its probe database (nmap-service-probes) to identify software and version.
sudo nmap -sV -p 22,80,443,3306 192.168.1.100
# 22/tcp open ssh OpenSSH 7.4
# 80/tcp open http nginx 1.18.0
# 3306/tcp open mysql MySQL 5.7.38Intensity Levels for -sV
The --version-intensity flag (0-9) controls how aggressively Nmap probes. Higher intensity finds more services but takes longer and is noisier.
sudo nmap -sV --version-intensity 9 192.168.1.100
# 9 = try all probes (slowest, most accurate)
# 0 = only most likely probes (fastest)OS Detection with -O
nmap -O uses TCP/IP stack fingerprinting — TTL values, TCP window sizes, IP options — to guess the OS. Results include confidence percentages.
sudo nmap -O 192.168.1.100
# OS details: Linux 4.15 - 5.6
# Network Distance: 1 hop
# Requires at least one open and one closed portAggressive Scan -A
-A enables OS detection, version detection, script scanning, and traceroute in one flag. Useful for quick comprehensive scans in lab environments.
sudo nmap -A 192.168.1.100
# Combines: -O -sV -sC --tracerouteBanner Grabbing with Netcat
Banner grabbing manually retrieves the service banner that servers send upon connection. This is a simple, low-noise alternative to full Nmap fingerprinting.
# HTTP banner
nc 192.168.1.100 80
GET / HTTP/1.0
# SSH banner
nc 192.168.1.100 22
# Returns: SSH-2.0-OpenSSH_8.9p1Banner Grabbing with curl
curl's -I flag fetches only response headers, revealing server software, version, and technology stack without downloading content.
curl -I http://192.168.1.100
# HTTP/1.1 200 OK
# Server: Apache/2.4.52 (Ubuntu)
# X-Powered-By: PHP/8.1.2Whatweb for Web Fingerprinting
WhatWeb identifies web technologies: CMS, JavaScript libraries, analytics, server software, and frameworks. It is purpose-built for web application recon.
whatweb http://target.com
# Output:
# WordPress [v6.2], Apache[2.4.52],
# PHP[8.1], jQuery[3.6.0]Nmap Scripting Engine for Fingerprinting
NSE scripts extend Nmap's fingerprinting capability. The http-server-header, ssh-hostkey, and banner scripts extract detailed information.
nmap --script=banner 192.168.1.100
nmap --script=http-server-header 192.168.1.100
nmap --script=ssh-hostkey 192.168.1.100Correlating with CVEs
Once you have service versions, search the National Vulnerability Database (NVD) or use tools like searchsploit to find known exploits matching the exact version.
searchsploit apache 2.4.49
searchsploit openssh 7.4
# Or search NVD:
# https://nvd.nist.gov/vuln/searchEvading Fingerprinting as a Defender
Defenders can obscure banners: remove Server headers, customize SSH banners, and use port-knocking. But security through obscurity only raises the bar — it is not a fix.
# Apache: suppress version
ServerTokens Prod
ServerSignature Off
# Nginx
server_tokens off;Quick Check
Which Nmap flag combines OS detection, version detection, and script scanning?
Summary: Fingerprinting
Fingerprinting transforms raw port lists into actionable intelligence. Combine -sV and -O for automated detection, manual banner grabbing for low-noise confirmation, and WhatWeb for web stacks. Always cross-reference version strings against CVE databases.
Frequently asked questions
Is the “Service and OS Fingerprinting” lesson free?
Yes — the full text of “Service and OS Fingerprinting” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Service and OS Fingerprinting”?
Use Nmap -sV and -O to identify running services and operating systems. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Service and OS Fingerprinting” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Nmap Port Scanning Techniques
- Service and OS Fingerprinting
- Netcat: The Swiss Army Knife
- Network Enumeration Scripting