CAPECattack pattern

CAPEC-312 Active OS Fingerprinting

Low Official page ↗
Abstraction
Standard
Status
Stable
Likelihood of attack
Medium
Typical severity
Low
CAPEC version
3.9

Description

An adversary engages in activity to detect the operating system or firmware version of a remote target by interrogating a device, server, or platform with a probe designed to solicit behavior that will reveal information about the operating systems or firmware in the environment. Operating System detection is possible because implementations of common protocols (Such as IP or TCP) differ in distinct ways. While the implementation differences are not sufficient to 'break' compatibility with the protocol the differences are detectable because the target will respond in unique ways to specific probing activity that breaks the semantic or logical rules of packet construction for a protocol. Different operating systems will have a unique response to the anomalous input, providing the basis to fingerprint the OS behavior. This type of OS fingerprinting can distinguish between operating system types and versions.

Prerequisites

• The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.

Consequences

• Confidentiality: Read Data • Confidentiality, Access Control, Authorization: Hide Activities

Related

Att&ck technique · MITRE ATT&CK (1)

  • T1082 System Information Discovery technique

Child of · CAPEC (1)

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

Referenced by CAPEC · child of (16)

  • CAPEC-317 IP ID Sequencing Probe attack pattern
  • CAPEC-318 IP 'ID' Echoed Byte-Order Probe attack pattern
  • CAPEC-319 IP (DF) 'Don't Fragment Bit' Echoing Probe attack pattern
  • CAPEC-320 TCP Timestamp Probe attack pattern
  • CAPEC-321 TCP Sequence Number Probe attack pattern
  • CAPEC-322 TCP (ISN) Greatest Common Divisor Probe attack pattern
  • CAPEC-323 TCP (ISN) Counter Rate Probe attack pattern
  • CAPEC-324 TCP (ISN) Sequence Predictability Probe attack pattern
  • CAPEC-325 TCP Congestion Control Flag (ECN) Probe attack pattern
  • CAPEC-326 TCP Initial Window Size Probe attack pattern
  • CAPEC-327 TCP Options Probe attack pattern
  • CAPEC-328 TCP 'RST' Flag Checksum Probe attack pattern
  • CAPEC-329 ICMP Error Message Quoting Probe attack pattern
  • CAPEC-330 ICMP Error Message Echoing Integrity Probe attack pattern
  • CAPEC-331 ICMP IP Total Length Field Probe attack pattern
  • CAPEC-332 ICMP IP 'ID' Field Error Message Probe attack pattern

Referenced by CWE · attack pattern (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness