CAPEC-302: TCP FIN Scan
CAPEC版本: 3.9
更新日期: 2023-01-24
攻击模式描述
An adversary uses a TCP FIN scan to determine if ports are closed on the target machine. This scan type is accomplished by sending TCP segments with the FIN bit set in the packet header. The RFC 793 expected behavior is that any TCP segment with an out-of-state Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be handled with a RST in response. This behavior should allow the adversary to scan for closed ports by sending certain types of rule-breaking packets (out of sync or disallowed by the TCB) and detect closed ports via RST packets.
执行流程
步骤 1 Experiment
An adversary sends TCP packets with the FIN flag but not associated with an existing connection to target ports.
步骤 2 Experiment
An adversary uses the response from the target to determine the port's state. If no response is received the port is open. If a RST packet is received then the port is closed.
前提条件
- FIN scanning requires the use of raw sockets, and thus cannot be performed from some Windows systems (Windows XP SP 2, for example). On Unix and Linux, raw socket manipulations require root privileges.
所需资源
- This attack pattern requires the ability to send TCP FIN segments to a host during network reconnaissance. This can be achieved via the use of a network mapper or scanner, or via raw socket programming in a scripting language. Packet injection tools are also useful for this purpose. Depending upon the method used it may be necessary to sniff the network in order to see the response.
后果影响
影响范围: Confidentiality
技术影响: Other
影响范围: Confidentiality Access Control Authorization
技术影响: Bypass Protection Mechanism
缓解措施
FIN scans are detected via heuristic (non-signature) based algorithms, much in the same way as other scan types are detected. An IDS/IPS system with heuristic algorithms is required to detect them.