CAPECattack pattern
CAPEC-313 Passive OS Fingerprinting
Low
Official page ↗
- Abstraction
- Standard
- Status
- Stable
- Likelihood of attack
- High
- Typical severity
- Low
- CAPEC version
- 3.9
Description
An adversary engages in activity to detect the version or type of OS software in a an environment by passively monitoring communication between devices, nodes, or applications. Passive techniques for operating system detection send no actual probes to a target, but monitor network or client-server communication between nodes in order to identify operating systems based on observed behavior as compared to a database of known signatures or values. While passive OS fingerprinting is not usually as reliable as active methods, it is generally better able to evade detection.
Prerequisites
• The ability to monitor network communications.Access to at least one host, and the privileges to interface with the network interface card.
Consequences
• Confidentiality: Read Data
• Confidentiality, Access Control, Authorization: Hide Activities
Related
Att&ck technique · MITRE ATT&CK (1)
- T1082 System Information Discovery technique
Child of · CAPEC (1)
- CAPEC-224 Fingerprinting attack pattern
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
Referenced by CWE · attack pattern (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness