# Fingerprintx | Standalone Utility For Service Discovery On Open Ports

**URL:** <https://onehack.st/t/fingerprintx-standalone-utility-for-service-discovery-on-open-ports/235724>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, privacy, freebies\
**Created:** [March 31, 2023, 11:53pm UTC](https://onehack.st/t/fingerprintx-standalone-utility-for-service-discovery-on-open-ports/235724 "2023-03-31T23:53:27Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [March 31, 2023, 11:53pm UTC](https://onehack.st/t/fingerprintx-standalone-utility-for-service-discovery-on-open-ports/235724/1 "2023-03-31T23:53:28Z")

</div>

# [![fingerprintx](https://github.com/praetorian-inc/fingerprintx/raw/main/static/fingerprintx-logo.png)](https://github.com/praetorian-inc/fingerprintx/blob/main/static/fingerprintx-logo.png)

[![](https://camo.githubusercontent.com/2a2157c971b7ae1deb8eb095799440551c33dcf61ea3d965d86b496a5a65df55/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d417061636865253230322e302d626c75652e737667)](https://opensource.org/licenses/Apache-2.0) [![](https://camo.githubusercontent.com/f5054ffcd4245c10d3ec85ef059e07aacf787b560f83ad4aec2236364437d097/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f636f6e747269627574696f6e732d77656c636f6d652d627269676874677265656e2e7376673f7374796c653d666c6174)](https://github.com/praetorian-inc/fingerprintx/issues) [![](https://camo.githubusercontent.com/efb913385c82ce1a26e0ee42818d599f1f559ee95af5c55a1c40f9e99ac62cbd/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f76657273696f6e2d76312e302e302d626c7565)](https://github.com/praetorian-inc/fingerprintx/releases)

[Features](https://github.com/praetorian-inc/fingerprintx#features) • [Installation](https://github.com/praetorian-inc/fingerprintx#installation) • [Usage](https://github.com/praetorian-inc/fingerprintx#usage) • [Running fingerprintx](https://github.com/praetorian-inc/fingerprintx#running-fingerprintx) • [Why not nmap?](https://github.com/praetorian-inc/fingerprintx#why-not-nmap) • [Notes](https://github.com/praetorian-inc/fingerprintx#notes) • [Acknowledgements](https://github.com/praetorian-inc/fingerprintx#acknowledgements)

`fingerprintx` is a utility similar to [httpx](https://github.com/projectdiscovery/httpx) that also supports fingerprinting services like as RDP, SSH, MySQL, PostgreSQL, Kafka, etc. `fingerprintx` can be used alongside port scanners like [Naabu](https://github.com/projectdiscovery/naabu) to fingerprint a set of ports identified during a port scan. For example, an engineer may wish to scan an IP range and then rapidly fingerprint the service running on all the discovered ports.

# Features

- Fast fingerprinting of exposed services
- Application layer service discovery
- Plays nicely with other command line tools
- Automatic metadata collection from identified services

[![Fingerprintx Example](https://github.com/praetorian-inc/fingerprintx/raw/main/static/fingerprintx-usage.png)](https://github.com/praetorian-inc/fingerprintx/blob/main/static/fingerprintx-usage.png)

[![Fingerprintx Chain Example](https://github.com/praetorian-inc/fingerprintx/raw/main/static/fingerprintx-chain.png)](https://github.com/praetorian-inc/fingerprintx/blob/main/static/fingerprintx-chain.png)

[![Fingerprintx SMB Example](https://github.com/praetorian-inc/fingerprintx/raw/main/static/fingerprintx-smb.png)](https://github.com/praetorian-inc/fingerprintx/blob/main/static/fingerprintx-smb.png)

## Supported Protocols:

| SERVICE | TRANSPORT | SERVICE | TRANSPORT |
| --- | --- | --- | --- |
| HTTP | TCP | REDIS | TCP |
| SSH | TCP | MQTT3 | TCP |
| MODBUS | TCP | VNC | TCP |
| TELNET | TCP | MQTT5 | TCP |
| FTP | TCP | RSYNC | TCP |
| SMB | TCP | RPC | TCP |
| DNS | TCP | OracleDB | TCP |
| SMTP | TCP | RTSP | TCP |
| PostgreSQL | TCP | MQTT5 | TCP (TLS) |
| RDP | TCP | HTTPS | TCP (TLS) |
| POP3 | TCP | SMTPS | TCP (TLS) |
| KAFKA | TCP | MQTT3 | TCP (TLS) |
| MySQL | TCP | RDP | TCP (TLS) |
| MSSQL | TCP | POP3S | TCP (TLS) |
| LDAP | TCP | LDAPS | TCP (TLS) |
| IMAP | TCP | IMAPS | TCP (TLS) |
| SNMP | UDP | Kafka | TCP (TLS) |
| OPENVPN | UDP | NETBIOS-NS | UDP |
| IPSEC | UDP | DHCP | UDP |
| STUN | UDP | NTP | UDP |
| DNS | UDP | | |

# Installation

From Github

go install [github.com/praetorian-inc/fingerprintx/cmd/fingerprintx@latest](http://github.com/praetorian-inc/fingerprintx/cmd/fingerprintx@latest)

From source (go version \> 1.18)

$ git clone [git@github.com](mailto:git@github.com):praetorian-inc/fingerprintx.git $ cd fingerprintx # with go version \> 1.18 $ go build ./cmd/fingerprintx $ ./fingerprintx -h

Docker

$ git clone [git@github.com](mailto:git@github.com):praetorian-inc/fingerprintx.git $ cd fingerprintx # build docker build -t fingerprintx . # and run it docker run --rm fingerprintx -h docker run --rm fingerprintx -t [praetorian.com:80](http://praetorian.com:80) --json

# Usage

fingerprintx -h

The `-h` option will display all of the supported flags for `fingerprintx`.

Usage: fingerprintx [flags] TARGET SPECIFICATION: Requires a host and port number or ip and port number. The port is assumed to be open. HOST:PORT or IP:PORT EXAMPLES: fingerprintx -t [praetorian.com:80](http://praetorian.com:80) fingerprintx -l input-file.txt fingerprintx --json -t [praetorian.com:80](http://praetorian.com:80),127.0.0.1:8000 Flags: --csv output format in csv -f, --fast fast mode -h, --help help for fingerprintx --json output format in json -l, --list string input file containing targets -o, --output string output file -t, --targets strings target or comma separated target list -w, --timeout int timeout (milliseconds) (default 500) -U, --udp run UDP plugins -v, --verbose verbose mode

The `fast` mode will only attempt to fingerprint the default service associated with that port for each target. For example, if `praetorian.com:8443` is the input, only the `https` plugin would be run. If `https` is not running on `praetorian.com:8443`, there will be NO output. Why do this? It’s a quick way to fingerprint most of the services in a large list of hosts (think the [80/20 rule](https://en.wikipedia.org/wiki/Pareto_principle)).

# Running Fingerprintx

With one target:

$ fingerprintx -t 127.0.0.1:8000 [http://127.0.0.1:8000](http://127.0.0.1:8000)

By default, the output is in the form: `SERVICE://HOST:PORT`. To get more detailed service output specify JSON with the `--json` flag:

$ fingerprintx -t 127.0.0.1:8000 --json {“ip”:“127.0.0.1”,“port”:8000,“service”:“http”,“transport”:“tcp”,“metadata”:{“responseHeaders”:{“Content-Length”:[“1154”],“Content-Type”:[“text/html; charset=utf-8”],“Date”:[“Mon, 19 Sep 2022 18:23:18 GMT”],“Server”:[“SimpleHTTP/0.6 Python/3.10.6”]},“status”:“200 OK”,“statusCode”:200,“version”:“SimpleHTTP/0.6 Python/3.10.6”}}

Pipe in output from another program (like [naabu](https://github.com/projectdiscovery/naabu)):

$ naabu 127.0.0.1 -silent 2\>/dev/null | fingerprintx [http://127.0.0.1:8000](http://127.0.0.1:8000) ftp://127.0.0.1:21

Run with an input file:

```auto
$ cat input.txt | fingerprintx
http://praetorian.com:80
telnet://telehack.com:23

# or if you prefer
$ fingerprintx -l input.txt
http://praetorian.com:80
telnet://telehack.com:23

```

With more metadata output:

```auto
$ cat input.txt | fingerprintx --json
{"host":"praetorian.com","ip":"146.148.61.165","port":80,"service":"http","transport":"tcp","metadata":{"responseHeaders":{"Connection":["keep-alive"],"Content-Type":["text/html"],"Date":["Mon, 19 Sep 2022 18:37:55 GMT"],"Etag":["W/\"5e3e263f-1703\""],"Keep-Alive":["timeout=20"],"Server":["nginx"],"Vary":["Accept-Encoding"]},"status":"404 Not Found","statusCode":404,"version":"nginx"}}
{"host":"telehack.com","ip":"64.13.139.230","port":23,"service":"telnet","transport":"tcp","metadata":{"serverData":"fffb03"}}

```

# Why Not Nmap?

[Nmap](https://nmap.org/) is the standard for network scanning. Why use `fingerprintx` instead of nmap? The main two reasons are:

- `fingerprintx` works smarter, not harder: the first plugin run against a server with port 8080 open is the http plugin. The default service approach cuts down scanning time in the best case. Most of the time the services running on port 80, 443, 22 are http, https, and ssh – so that’s what `fingerprintx` checks first.
- `fingerprintx` supports json output with the `--json` flag. Nmap supports numerous output options (normal, xml, grep), but they are often hard to parse and script appropriately. `fingerprintx` supports json output which eases integration with other tools in processing pipelines.

# Notes

- Why do you have a `third_party` folder that imports the Go cryptography libraries?
  - Good question! The `ssh` fingerprinting module identifies the various cryptographic options supported by the server when collecting metadata during the handshake process. This makes use of a few unexported functions, which is why the Go cryptography libraries are included here with an [export.go file](https://github.com/praetorian-inc/fingerprintx/blob/main/third_party/cryptolib/ssh/export.go).

- Fingerprintx is not designed to identify open ports on the target systems and assumes that every `target:port` input is open. If none of the ports are open there will be no output as there are no services running on the targets.
- How does this compare to [zgrab2](https://github.com/zmap/zgrab2)?
  - The `zgrab2` command line usage (and use case) is slightly different than `fingerprintx`. For `zgrab2`, the protocol must be specified ahead of time: `echo praetorian.com | zgrab2 http -p 8000`, which assumes you already know what is running there. For `fingerprintx`, that is not the case: `echo praetorian.com:8000 | fingerprintx`. The “application layer” protocol scanning approach is very similar.

# Acknowledgements

`fingerprintx` is the work of a lot of people, including our great intern class of 2022. Here is a list of contributors so far:

- [praetorian-sohamroy](https://github.com/praetorian-sohamroy)
- [jue-huang](https://github.com/jue-huang)
- [henryjung64](https://github.com/henryjung64)
- [qwetboy10](https://github.com/qwetboy10)
- [jwhenry28](https://github.com/jwhenry28)
- [noahtutt](https://github.com/noahtutt)

## GitHub:

[https://github.com/praetorian-inc/fingerprintx](https://github.com/praetorian-inc/fingerprintx)