COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-323

TCP (ISN) Counter Rate Probe

This OS detection probe measures the average rate of initial sequence number increments during a period of time. Sequence numbers are incremented using a time-based algorithm and are susceptible to a timing analysis that can determine the number of increments per unit time. The result of this analysis is then compared against a database of operating systems and versions to determine likely operation system matches.

Soyutlama

Detailed

Tipik ciddiyet

Low

Saldırı ihtimali

Medium

Saldırıyı anla

Bu saldırı kalıbı nedir?

This OS detection probe measures the average rate of initial sequence number increments during a period of time. Sequence numbers are incremented using a time-based algorithm and are susceptible to a timing analysis that can determine the number of increments per unit time. The result of this analysis is then compared against a database of operating systems and versions to determine likely operation system matches.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.

Gerekli beceri

MITRE kaydında belirtilmemiş.

Gerekli kaynak

  • Any type of active probing that involves non-standard packet headers requires the use of raw sockets, which is not available on particular operating systems (Microsoft Windows XP SP 2, for example). Raw socket manipulation on Unix/Linux requires root privileges. A tool capable of sending and receiving packets from a remote system.

Etki

Başarılı saldırı neye yol açar?

Read Data

Etkilenen alanlar: Confidentiality

Bypass Protection MechanismHide Activities

Etkilenen alanlar: Confidentiality, Access Control, Authorization

CAPEC-323: TCP (ISN) Counter Rate Probe — DayBreach Saldırı Sözlüğü · DayBreach