XPROBE2(1)

📦 version 0.3, in ubuntu jammy

💖 XPROBE2 💖

okay bestie, so this is the manual page for xprobe2, and it lives in the General Commands Manual section — that's the XPROBE2(1) situation, iykyk. it's a remote active operating system fingerprinting tool, and she is that girl. let's get into it 🦋

✨ NAME ✨

xprobe2 — a remote active operating system fingerprinting tool. periodt. 💅

🌸 SYNOPSIS 🌸

xprobe2 [ -v ] [ -r ] [ -p proto:portnum:state ] [ -c configfile ] [ -o
logfile ] [ -p port ] [ -t receive_timeout ] [ -m numberofmatches ] [ -D
modnum ] [ -F ] [ -X ] [ -B ] [ -A ] [ -T port spec ] [ -U port spec ]
host

like yes, that's a lot of brackets, but she's flexible okay 😭

💫 DESCRIPTION 💫

xprobe2 is an active operating system fingerprinting tool that takes a whole different approach to OS fingerprinting, and honestly? it's giving main character energy. instead of doing the basic thing, xprobe2 relies on:

  • fuzzy signature matching
  • probabilistic guesses
  • multiple matches simultaneously
  • a signature database

the way she operates is described in a paper titled "xprobe2 - A ´Fuzzy´ Approach to Remote Active Operating System Fingerprinting", which you can grab from http://www.sys-security.com/html/projects/X.html 📄✨

⚠️ okay this part matters a LOT: because xprobe2 uses raw sockets to send probes, you must have root privileges for xprobe2 to be able to use them. no root, no probes, no vibes. 🔥

🎀 OPTIONS 🎀

  • -v — be verbose. she's talking, and you WILL listen. 🗣️
  • -r — display route to target. it's a traceroute-like output, lowkey iconic. 🛣️
  • -c — use configfile to read the configuration file, xprobe2.conf, from a non-default location. moving day, bestie. 📦
  • -D — disable module number modnum. not every module gets a seat at the table. 💀
  • -m — set number of results to display to numofmatches. quality over quantity, fr fr. 📊
  • -o — use logfile to log everything (default output is stderr). write it down so you don't forget ✍️
  • -p — specify port number (portnum), protocol (proto) and it's state for xprobe2 to use during rechability/fingerprinting tests of remote host. possible values for proto are tcp or udp, portnum can only take values from 1 to 65535, and state can be either:
    • closed — for tcp that means that remote host replies with RST packet, for udp that means that remote host replies with ICMP Port Unreachable packet
    • open — for tcp that means that remote host replies with SYN ACK packet and for udp that means that remote host doesn't send any packet back

she contains multitudes, okay? 🌈

  • -t — set receive timeout to receive_timeout in seconds (the default is set to 10 seconds). patience is a virtue but ten seconds is ten seconds ⏳
  • -F — generate signature for specified target (use -o to save fingerprint into file). glow-up, but make it a fingerprint ✨
  • -X — write XML output to logfile specified with -o. fancy formatting, we love to see it 💅
  • -B — causes xprobe2 to be a bit more noisy, as -B makes TCP handshake module to try and blindly guess an open TCP port on the target, by sending sequential probes to the following well-known ports: 80, 443, 23, 21, 25, 22, 139, 445 and 6000 hoping to get SYN ACK reply. if xprobe2 receives RST|ACK or SYN|ACK packets for a port in the list above, it will be saved in the target port database to be later used by other modules (i.e. RST module). loud and proud, honestly 🔊
  • -T, -U — enable built-in portscanning module, which will attempt to scan TCP and/or UDP ports respectively, which were specified in port spec. multitasking queen 👑
  • -A — enable experimental support for detection of transparent proxies and firewalls/NIDSs spoofing RST packets in portscanning module. option should be used in conjunction with -T. all responses from target gathered during portscanning process are divided in two classes (SYN|ACK and RST) and saved for analysis. during analysis module will search for different packets, based on some of the fields of TCP and IP headers, within the same class and if such packets are found, message will be displayed showing different packets within the same class. detective mode: activated 🔍

🧚 EXAMPLES 🧚

xprobe2 -v -D 1 -D 2 192.168.1.10

will launch an OS fingerprinting attempt targeting 192.168.1.10. modules 1 and 2, which are reachability tests, will be disabled, so probes will be sent even if target is down. output will be verbose. she's persistent, what can I say 😤

xprobe2 -v -p udp:53:closed 192.168.1.20

will launch an OS fingerprint attempt targeting 192.168.1.20. the UDP destination port is set to 53, and the output will be verbose. 🍓

xprobe2 -M 11 -p tcp:80:open 192.168.1.1

will only enable TCP handshake module (number 11) to probe the target, very useful when all ICMP traffic is filtered. when the vibes are blocked, we route around them 💫

xprobe2 -B 192.168.1.1

will cause TCP handshake module to try blindly guess open port on the target by sequentially sending TCP packets to the most likely open ports (80, 443, 23, 21, 25, 22, 139, 445 and 6000). 🎯

xprobe2 -T 1-1024 127.0.0.1

will enable portscanning module, which will scan TCP ports starting from 1 to 1024 on 127.0.0.1. 🧹

xprobe2 -p tcp:139:open 192.168.1.2

if remote target has TCP port 139 open, the command line above will enable application level SMB module (if remote target has TCP port 445 open, substitue 139 in the command line with 445). 🗂️

xprobe2 -p udp:161:open 192.168.1.10

will enable SNMPv2c application level module, which will try to retrieve sysDescr.0 OID using community strings taken from xprobe2.conf file. nosy in the best way 💜

🫶 NOTES 🫶

xprobe2 fingerprints remote operating system by analyzing the replies from the target, so to get the most out of xprobe2 you need to supply xprobe2 with as much information as possible. in particular it is important to supply at least one open TCP port and one closed UDP port. 🔑

open TCP port can either be provided in command line (-p), obtained through built-in portscanner (-T) or -B option can be used to cause xprobe2 to try to blindly guess open TCP port. UDP port can be supplied via command line (-p) or through built-in portscanner (-U).

so basically: feed her data. she thrives on it. 🌸

📜 HISTORY 📜

xprobe has been developed in 2001 based on research performed by Ofir Arkin <ofir@sys-security.com>. the code has been officially released at the BlackHat Briefings in Las-Vegas in 2001. xprobe2 is a logical evolution of xprobe code. signature based fuzzy fingerprinting logic was embedded. a glow-up arc for the history books, no cap ✨👑

👀 SEE ALSO 👀

nmap(1) queso(1) pcap(3)

💖 AUTHORS 💖

  • Fyodor Yarochkin <fyodor@o0o.nu>
  • Ofir Arkin <ofir@sys-security.com>
  • Meder Kydyraliev <meder@o0o.nu>

(see also CREDITS in distro tarball). the girlies who built her 💅

🌈 AVAILABILITY 🌈

the current version and relevant documentation is available from following url:

https://sourceforge.net/projects/xprobe/

go get her, bestie 🛍️

💀 BUGS 💀

None known (please report).

not me being shocked that there are zero known bugs 😭 but like, if you find one, PLEASE report it.

and that's the whole page, fr fr. this was the XPROBE2(1) manual page from the General Commands Manual, and we are officially done here. stay fuzzy, stay root, and go fingerprint something responsibly 🎀✨💅

📦 where this page comes from