> For the complete documentation index, see [llms.txt](https://ceh-practical.cavementech.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ceh-practical.cavementech.com/module-3.-scanning-networks/3.-perform-os-discovery.md).

# 3. Perform OS Discovery

<figure><img src="/files/1racHtsgL1jjAGoLcG2Q" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/MBY06N8f9knin6AY3jbj" alt=""><figcaption></figcaption></figure>

## <mark style="color:red;">1. Identify OS with TTL in wireshark</mark>

Follow TCP stream in wireshark. Check the ICMP reply after pinging. If TTL is around 128, its Windows, if around 64, its Linux

## 2. Perform OS Discovery using NSE scripting Engine

```
sudo nmap -O 192.168.18.110
sudo nmap -A 192.168.18.110
```

Enumerating OS details with nmap script over smb

```
sudo nmap --script smb-os-discovery.nse 192.168.18.110
```

<figure><img src="/files/Tu9PlBq1IKsd0ExEJOIF" alt=""><figcaption></figcaption></figure>

## <mark style="color:red;">3. Unicornscan</mark>

{% embed url="<https://www.kali.org/tools/unicornscan/>" %}

```
unicornscan 192.168.18.100 - Iv
```

-I is for immediate scan and v  is for verbose scan.

{% embed url="<https://www.udemy.com/course/ethical-hacker-practical/?referralCode=289CF01CF51246BCAD6C>" %}