OS Fingerprinting From Scratch (Or) Offensive Scapy

on YouTube ↗17m

" summary

Passive OS fingerprinting that extracts the DHCP option 55 parameter request list with Scapy, maps the requesting MAC to an IP via ARP, and matches the integer sequence against a local sqlite or the Fingerbank API to infer OS (examples: Ubuntu 20.04, Windows). A working sniffer and whitelist/alert system exists (can email on unknown strings). Limitations: long DHCP leases, absent DHCP/IPv6 or unseen parameter lists, and sensor placement affects visibility.

AI-written summary · about

" chapters (14)

1. 0:00Introduction to talk
2. 0:44What is Scapy
3. 1:04Why OS fingerprinting
4. 2:05Limitations of Nmap
5. 3:09Basic OS detection tricks
6. 5:57Port-based OS inference
7. 6:18Active vs passive fingerprinting
8. 8:22Passive fingerprinting with DHCP
9. 10:49Abusing DHCP option 55
10. 12:13Demo with Scapy and SQLite
11. 13:38Future of DHCP fingerprinting
12. 14:19Defensive use of code
13. 15:43Limitations and challenges
14. 16:49Closing remarks and resources

" related talks

• 44mNetsec is Dead(?): Modern Network Fingerprinting for...Vlad Iliushin · BSidesSF 2025
• 43ma journey...Sergey Volkovich · BSides Edmonton 2025
• 21mFp-Scanner: The Privacy Implications of Browser Fingerprint InconsistenciesAntoine Vastel, Pierre Laperdrix, Walter Rudametkin, Romain Rouvoy · USENIX Security '18
• 32mHey Attacker! I Can See You!Ross Bevington · HITBSecConf 2019 Amsterdam
• 41mInternet Spelunking: IPv6 Scanning and Device FingerprintingPiotr Kijewski, Dave De Coster · 34th Annual FIRST Conference 2022
• 49mLeveraging MacOS's Networking Frameworks to Heuristically Detect MalwarePatrick Wardle · RSA Conference 2024
• 40mAn Analysis of the Fingerprinting-Scripts and their Actors on the InternetSebastian Neef · code.talks 2022
• 44mPassive Fingerprinting of HTTP/2 ClientsElad Shuster · OWASP AppSec Europe 2018