By OS fingerprint I mean:

nmap -O target

You must run that as root for some reason. It will try to tell you what ports are open, and attempt to identify the OS and it’s version. This doesn’t always give you clear results – especially if the target is well configured and locked down tight.

I usually use Apache + PHP for most of my coding. I forget that IIS is kinda “built into” windows. :P Sorry…

My preferred environment is LAMP (Linux, Apache, MySQL, PHP). I do work with one WIMP server (Windows, IIS, MySQL, PHP) but I really don’t do all that much with it.

Of course I mean “inherantly”, it’s been a hard day’s work. :D

Well, if they are running IIS 6.0 then, inhertantly, they must be running Windows Server 2003. Isn’t that so? :)

Btw… Could you tell me more about this fingerprint business? Perhaps you even know how to do a backward dns-lookup to see what dns-servers the domain is registered on?

Indeed, you can run ASP 3.0 at the same time as .Net. The fact that you can saved me from many hours of boring coding a while ago when I was fixing an old CMS; with me using .Net of course.

Heh, true. But a an OS fingerprint may tell you which version of Windows is running on the machine.

You can mix unmanaged code with .NET stuff, no? Not the best idea, but I think it can be done. My ASP skills are a bit rusty…

I’m guessing they are running some legacy code or something like that.

U don’t have to do a fingerprint. Just look at the response headers:
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET

Then you might ask yourself what an ASP.Net server is doing with Classic ASP code.