CAPECattack pattern
CAPEC-328 TCP 'RST' Flag Checksum Probe
Low
Official page ↗
- Abstraction
- Detailed
- Status
- Stable
- Likelihood of attack
- Medium
- Typical severity
- Low
- CAPEC version
- 3.9
Description
This OS fingerprinting probe performs a checksum on any ASCII data contained within the data portion or a RST packet. Some operating systems will report a human-readable text message in the payload of a 'RST' (reset) packet when specific types of connection errors occur. RFC 1122 allows text payloads within reset packets but not all operating systems or routers implement this functionality.
Prerequisites
• The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.
Consequences
• Confidentiality: Read Data
• Confidentiality, Access Control, Authorization: Bypass Protection Mechanism, Hide Activities
Related
Child of · CAPEC (1)
- CAPEC-312 Active OS Fingerprinting attack pattern
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
Referenced by CWE · attack pattern (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness