OS and application fingerprinting

OS and application fingerprinting

Linux 2.6/2.4
Apache Tomcat
Apache/2.0.59 (Unix) PHP/4.4.7 mod_jk/1.2.25

[user@]$ sudo nmap -O x.y.z.t

Starting Nmap 5.51 ( http://nmap.org ) at 2011-07-29 12:41 ICT
Nmap scan report for x.y.z.t
Host is up (0.10s latency).
Not shown: 995 filtered ports
PORT    STATE  SERVICE
25/tcp  closed smtp
80/tcp  open   http
110/tcp closed pop3
143/tcp closed imap
587/tcp closed submission
Device type: general purpose|WAP|PBX|router
Running (JUST GUESSING): Linux 2.6.X (96%), Ubiquiti Linux (90%), Linksys embedded (89%)
Aggressive OS guesses: Linux 2.6.9 - 2.6.30 (96%), Linux 2.6.22 (Fedora Core 6) (94%), Linux 2.6.28 (Gentoo) (93%), Linux 2.6.21 (92%), Linux 2.6.24 - 2.6.35 (92%), Linux 2.6.9 - 2.6.31 (92%), Linux 2.6.13 - 2.6.31 (92%), Linux 2.6.23 - 2.6.26 (92%), Linux 2.6.22 (92%), Linux 2.6.24 - 2.6.28 (92%)
No exact OS matches for host (test conditions non-ideal).

OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.33 seconds
[user@]$ sudo amap x.y.z.t 80
amap v5.4 (www.thc.org/thc-amap) started at 2011-07-29 12:41:55 - APPLICATION MAPPING mode

Protocol on x.y.z.t:80/tcp matches http
Protocol on x.y.z.t:80/tcp matches http-apache-2
Protocol on x.y.z.t:80/tcp matches http-jrun
Protocol on x.y.z.t:80/tcp matches http-tomcat

Unidentified ports: none.

[user@]$ sudo amap -vd x.y.z.t 80
Using trigger file ./appdefs.trig ... loaded 30 triggers
Using response file ./appdefs.resp ... loaded 346 responses
Using trigger file ./appdefs.rpc ... loaded 450 triggers

amap v5.4 (www.thc.org/thc-amap) started at 2011-07-29 12:46:04 - APPLICATION MAPPING mode

Total amount of tasks to perform in plain connect mode: 23
Waiting for timeout on 23 connections ...
Protocol on x.y.z.t:80/tcp matches http
Dump of identified response from x.y.z.t:80/tcp (by trigger http):
0000:  4854 5450 2f31 2e31 2032 3030 204f 4b0d    [ HTTP/1.1 200 OK. ]
0010:  0a44 6174 653a 2046 7269 2c20 3239 204a    [ .Date: Fri, 29 J ]
0020:  756c 2032 3031 3120 3035 3a34 373a 3531    [ ul 2011 05:47:51 ]
0030:  2047 4d54 0d0a 5365 7276 6572 3a20 4170    [  GMT..Server: Ap ]
0040:  6163 6865 2f32 2e30 2e35 3920 2855 6e69    [ ache/2.0.59 (Uni ]
0050:  7829 2050 4850 2f34 2e34 2e37 206d 6f64    [ x) PHP/4.4.7 mod ]
0060:  5f6a 6b2f 312e 322e 3235 0d0a 5365 742d    [ _jk/1.2.25..Set- ]
0070:  436f 6f6b 6965 3a20 4a53 4553 5349 4f4e    [ Cookie: JSESSION ]
0080:  4944 3d42 4333 3445 4537 3139 4634 3230    [ ID=BC34EE719F420 ]
0090:  3939 4637 3643 4138 3146 3430 3545 3635    [ 99F76CA81F405E65 ]
00a0:  4532 372e 6c6f 6361 6c68 6f73 743a 3830    [ E27.localhost:80 ]
00b0:  3039 3b20 5061 7468 3d2f 0d0a 436f 6e74    [ 09; Path=/..Cont ]
00c0:  656e 742d 4c61 6e67 7561 6765 3a20 656e    [ ent-Language: en ]
00d0:  2d55 530d 0a43 6f6e 7465 6e74 2d4c 656e    [ -US..Content-Len ]
00e0:  6774 683a 2035 3339 370d 0a56 6172 793a    [ gth: 5397..Vary: ]
00f0:  2041 6363 6570 742d 456e 636f 6469 6e67    [  Accept-Encoding ]
0100:  0d0a 5033 503a 2043 503d 224e 4f49 2044    [ ..P3P: CP="NOI D ]
0110:  5350 2043 4f52 2041 444d 2044 4556 204f    [ SP COR ADM DEV O ]
0120:  5552 2053 5450 220d 0a43 6f6e 6e65 6374    [ UR STP"..Connect ]
0130:  696f 6e3a 2063 6c6f 7365 0d0a 436f 6e74    [ ion: close..Cont ]
0140:  656e 742d 5479 7065 3a20 7465 7874 2f68    [ ent-Type: text/h ]
0150:  746d 6c3b 6368 6172 7365 743d 5769 6e64    [ tml;charset=Wind ]
0160:  6f77 732d 3331 4a0d 0a0d 0a0a 0a0a 0a0a    [ ows-xyzt......... ]