COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-324

TCP (ISN) Sequence Predictability Probe

This type of operating system probe attempts to determine an estimate for how predictable the sequence number generation algorithm is for a remote host. Statistical techniques, such as standard deviation, can be used to determine how predictable the sequence number generation is for a system. This result can then be compared to a database of operating system behaviors to determine a likely match for operating system and version.

Abstraction

Detailed

Typical severity

Low

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

This type of operating system probe attempts to determine an estimate for how predictable the sequence number generation algorithm is for a remote host. Statistical techniques, such as standard deviation, can be used to determine how predictable the sequence number generation is for a system. This result can then be compared to a database of operating system behaviors to determine a likely match for operating system and version.

Requirements

What does the attack require?

Prerequisites

  • The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.

Skills required

Not stated in the MITRE record.

Resources required

  • A tool capable of sending and receiving packets from a remote system.

Impact

What does a successful attack lead to?

Read Data

Affected scopes: Confidentiality

Bypass Protection MechanismHide Activities

Affected scopes: Confidentiality, Access Control, Authorization

CAPEC-324: TCP (ISN) Sequence Predictability Probe — DayBreach Saldırı Sözlüğü · DayBreach