COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-328

TCP 'RST' Flag Checksum Probe

This OS fingerprinting probe performs a checksum on any ASCII data contained within the data portion or a RST packet. Some operating systems will report a human-readable text message in the payload of a 'RST' (reset) packet when specific types of connection errors occur. RFC 1122 allows text payloads within reset packets but not all operating systems or routers implement this functionality.

Abstraction

Detailed

Typical severity

Low

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

This OS fingerprinting probe performs a checksum on any ASCII data contained within the data portion or a RST packet. Some operating systems will report a human-readable text message in the payload of a 'RST' (reset) packet when specific types of connection errors occur. RFC 1122 allows text payloads within reset packets but not all operating systems or routers implement this functionality.

Requirements

What does the attack require?

Prerequisites

  • The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.

Skills required

Not stated in the MITRE record.

Resources required

  • A tool capable of sending and receiving packets from a remote system.

Impact

What does a successful attack lead to?

Read Data

Affected scopes: Confidentiality

Bypass Protection MechanismHide Activities

Affected scopes: Confidentiality, Access Control, Authorization