search

cSploit / android

cSploit - The most complete and advanced IT security professional toolkit on Android.
http://www.csploit.org/
GNU General Public License v3.0
3.29k stars 1.1k forks source link

Incorrect OS detection (nightly) #467

Open ghost opened 8 years ago

ghost commented 8 years ago

When I run Inspector on a Windows 10 computer in my network, cSploit detects FreeBSD on it. screenshot_2015-10-25-16-35-32

gustavo-iniguez-goya commented 8 years ago

@ghost251101 , please, (always) post the logs. AFAIK usually nmap reports several OSs, with a % of probability, but we don't use this value. If this is the case I'll post a solution.

ghost commented 8 years ago

@gainan, This problem is concerning nmap, not csploit and I can confirm that nmap sometimes fail to correctly guess the running OS, on the selected machine ( which is absolutely normal with this kind of tool ). Maybe we could tweak the default nmap command to do a more precise scan when launching the scan in the inspector tab. Or show the % of chance for a device to run a specific OS.

gustavo-iniguez-goya commented 8 years ago

I'm agree with you @Settix . The problem on cSploit, and the easiest part to fix, is that if nmap reports 5 OSs with for example 80%, 90%, 96%, 97% and 83% of accuracy (in this order), we display the last one (the one with 83% of accuracy in this case).

This problem can be fixed on the native library or on the app. I fixed it on the app: https://github.com/cSploit/android/compare/develop...gainan:best_os_selection

gustavo-iniguez-goya commented 8 years ago

by the way, sometimes nmap reports the following (well, apparently now the results are in order, although the app receives them sorted in reverse order):

{ accuracy=96, os='embedded', type='WAP' } { accuracy=95, os='Linux', type='general purpose' } { accuracy=93, os='Linux', type='general purpose' } { accuracy=93, os='Linux', type='general purpose' } { accuracy=92, os='Linux', type='webcam' } { accuracy=92, os='Linux', type='general purpose' } { accuracy=92, os='Linux', type='general purpose' } { accuracy=92, os='Android', type='media device' } { accuracy=91, os='Linux', type='general purpose' } { accuracy=91, os='Linux', type='general purpose' } { accuracy=91, os='2-Series', type='specialized' }

in this case as mentioned above, we display 2-Series. However I think that we should take into account how many times nmap has reported an OS, and if it's greater than the one with more accuracy, use it.

ghost commented 8 years ago

@gainan you hit the point ;). Thanks for the fast reply and useful help !