COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-313

Passive OS Fingerprinting

An adversary engages in activity to detect the version or type of OS software in a an environment by passively monitoring communication between devices, nodes, or applications. Passive techniques for operating system detection send no actual probes to a target, but monitor network or client-server communication between nodes in order to identify operating systems based on observed behavior as compared to a database of known signatures or values. While passive OS fingerprinting is not usually as reliable as active methods, it is generally better able to evade detection.

Abstraction

Standard

Typical severity

Low

Likelihood of attack

High

Understand the attack

What is this attack pattern?

An adversary engages in activity to detect the version or type of OS software in a an environment by passively monitoring communication between devices, nodes, or applications. Passive techniques for operating system detection send no actual probes to a target, but monitor network or client-server communication between nodes in order to identify operating systems based on observed behavior as compared to a database of known signatures or values. While passive OS fingerprinting is not usually as reliable as active methods, it is generally better able to evade detection.

Requirements

What does the attack require?

Prerequisites

  • The ability to monitor network communications.Access to at least one host, and the privileges to interface with the network interface card.

Skills required

Not stated in the MITRE record.

Resources required

  • Any tool capable of monitoring network communications, like a packet sniffer (e.g., Wireshark)

Impact

What does a successful attack lead to?

Read Data

Affected scopes: Confidentiality

Hide Activities

Affected scopes: Confidentiality, Access Control, Authorization

CAPEC-313: Passive OS Fingerprinting — DayBreach Saldırı Sözlüğü · DayBreach