SINFP3(1)

NAME
sinfp3.pl - more than a passive and active OS fingerprinting tool

SYNOPSIS
   o Information about signature database updates and more:
   o https://www.secure-side.com/lists/mailman/listinfo/sinfp

sinfp3.pl [options] -target ip|ip6|hostname -port port|portList

Examples:

   # Single port active fingerprinting
   sinfp3.pl -target example.com -port 80 -input-ipport

   # Single port IPv6 active fingerprinting
   sinfp3.pl -target example.com -port 80 -input-ipport -6

   # SynScan active fingerprinting of a single target
   sinfp3.pl -target example.com -port top100

   # SynScan IPv6 active fingerprinting of a single target
   sinfp3.pl -target example.com -port top100 -6

   # SynScan active fingerprinting of a target subnet
   sinfp3.pl -target 192.0.43.0/24 -port top100

   # Passive fingerprinting
   sinfp3.pl -mode-passive -search-active -input-sniff

   # Passive IPv6 fingerprinting
   sinfp3.pl -mode-passive -search-active -input-sniff -6

   # Active fingerprinting of LAN
   sinfp3.pl -input-arpdiscover

   # Active fingerprinting of IPv6 LAN
   sinfp3.pl -input-arpdiscover -6

   # Simply SynScan the target
   sinfp3.pl -target example.com -port full -mode-null -search-null -db-null

OPTIONS

Global:
    -version
        Print sinfp3.pl version.

    -help
        This help message.

    -target ip|ip6|hostname
        Target. This is used to auto-detect some global parameters like device or ip.

    -port port|portList|top10|top100|top1000|all
        Target port. Default for top10 ports for plugins able to handle multiple ports. This format is documented in `perldoc Net::SinFP3::Global' expandPorts method.

    -port-src port
        Source port to use. Not supported by all plugins.

    -passive
        Use passive fingerprinting. Default to use active one.

    -6  Use IPv6 fingerprinting where available. Default to off.

    -jobs number
        Maximum number of jobs in parallel. Default: 10.

    -dns-reverse
        Do a reverse DNS lookup for targets. Default to no.

    -device name
        Network device to use. Default to auto-detect.

    -thread
        Use threaded worker model (discouraged). Fork is used by default (and in Perl, it is better than ithreads).

    -retry times
        Re-launch probes specified number of time. Default: 3.

    -timeout seconds
        Time in seconds before timing out. Default: 3.

    -pps number
        Number of packet per seconds. Default: 200.

    -ip-src ip
        The source IPv4 address to use. Default to auto-detect.

    -ip6-src ip6
        The source IPv6 address to use. Default to auto-detect.

    -mac-src mac
        The source MAC address to use. Default to auto-detect.

    -subnet-src subnet
        The source IPv4 subnet address to use. Default to auto-detect.

    -subnet6-src subnet
        The source IPv6 subnet address to use. Default to auto-detect.

    -ip-gateway ip
        The gateway IPv4 address to use. Default to auto-detect.

    -ip6-gateway ip6
        The gateway IPv6 address to use. Default to auto-detect.

    -mac-gateway mac
        The gateway MAC address to use. Default to auto-detect.

    -verbose level
        Use the following verbose level number. Between 0 and 3, from the less verbose to the most verbose. Default to 1.

    -quiet
        Set verbose level to 0. Default to not.

    -threshold score
        Use the specified threshold for plugins supporting it. Default to no threshold (0).

    -best-score
        Only gather results for the best matches. Default to not.

Manually select all plugins and their options:
    -input plugin
        Use specified plugin for input. Default input plugin is Net::SinFP3::Input::SynScan.

    -input-arg plugin-arg
        Parameter to the specified input plugin. Must use multiple times to give multiple parameters.

    -db plugin
        Use specified plugin for db. Default DB plugin is Net::SinFP3::DB::SinFP3. Example: "sinfp3.pl -db SinFP3 -db-arg file=sinfp3.db".

    -db-arg plugin-arg
        Parameter to the specified db plugin. Must use multiple times to give multiple parameters.

    -mode plugin
        Use specified plugin for mode. Default mode plugin is Net::SinFP3::Mode::Active.

    -mode-arg plugin-arg
        Parameter to the specified mode plugin. Must use multiple times to give multiple parameters.

    -search plugin
        Use specified plugin for search. Default search plugin is Net::SinFP3::Search::Active.

    -search-arg plugin-arg
        Parameter to the specified search plugin. Must use multiple times to give multiple parameters.

    -output plugin
        Use specified plugin for output. Default output plugin is Net::SinFP3::Output::Console.

    -output-arg plugin-arg
        Parameter to the specified output plugin. Must use multiple times to give multiple parameters.

Plugin loading options:
    -input-null
        Turn off input plugin.

    -input-arpdiscover
        Use ARP scanning on the local subnet to discover targets. Works also with -6 argument.

    -input-pcap
        Take a pcap file (or files) as input.

    -input-synscan
        Perform a TCP SYN scan to find open ports. Default plugin.

    -input-ipport
        Use only target IP or hostname and one port.

    -input-sniff
        Listen on the network to capture frames.

    -input-signature
        Will ask the end-user to past an active signature as a string.

    -input-signaturep
        Will ask the end-user to past a passive signature as a string.

    -input-connect
        Performs a standard TCP connect() and sends a "GET /HTTP/1.0". Then, it analyzes the SYN|ACK response to perform active fingerprinting.

    -input-server
        Starts a SinFP3 server on localhost:32000, so clients speaking the SinFP3 API will be able to access the fingerprinrint engine.

    -mode-null
        Turn off mode plugin.

    -mode-active
        Run using active plugin. This does active OS fingerprinting via SinFP3 engine.

    -mode-passive
        Run using passive plugin. This does passive OS fingerprinting via SinFP3 engine.

    -db-null
        Turn off DB plugin.

    -db-sinfp3
        Use Net::SinFP3::DB::SinFP3 database plugin. Default plugin.

    -search-null
        Turn off search plugin.

    -search-active
        Perform a search through a database in active mode. Default plugin.

    -search-passive
        Perform a search through a database in passive mode.

    -log-null
        Turn off log plugin.

    -log-console
        Log messages to the console. Default plugin.

    -output-null
        Turn off output plugin.

    -output-console
        Render output to the console with many details.

    -output-client
        Render output to the connected client using SinFP3 communication protocol.

    -output-simple
        Render output to the console, in a simple way. Default plugin.

    -output-dumper
        Prints a dump to the console.

    -output-osonly
        Only outputs operating system, and not full details of the fingerprint.

    -output-osversionfamily
        Only outputs operating system and its version family, and not full details of the fingerprint.

    -output-pcap
        Saves a trace to a pcap file. You can reply it afterwards using Net::SinFP3::Input::Pcap.

    -output-csv
        Saves fingerprinting results a csv file. You can use -csv-file to choose the output file.

    -output-ubigraph
        Takes a CSV file and display results using Ubigraph. You must use a CSV file as generated by Net::SinFP3::Output::CSV. You can use -csv-file to choose the input file.

Plugin specific options:
    -db-update
        Will update the database for the selected Net::SinFP3::DB plugin.

    -db-file file
        Database file to use. Default is plugin dependant.

    -sniff-promiscuous
        Use promiscuous mode while sniffing. Default to true.

    -pcap-anonymize
        Replaces IP source and destination addresses (and update IP/TCP checksums) to anonymize a pcap output. Default to not.

    -pcap-append
        Append to an already existing pcap file. Default to not.

    -pcap-filter pcap
        Use specified pcap filter. Use it where available.

    -csv-file file
        Use input taken from specified CSV file.

    -pcap-file file|fileList
        Use input taken from specified pcap file or fileList. FileList uses Perl glob function.

    -active-3
        Run all probes in active mode (default).

    -active-2
        Run only probes P1 and P2 in active mode (stealthier).

    -active-1
        Run only probe P2 in active mode (even stealthier).

    -synscan-fingerprint
        Do not perform classic 3 packets fingerprinting, just use the SYN|ACK reply from the SYN request for fingerprinting.