CAPEC-305: TCP ACK Scan
CAPEC版本: 3.9
更新日期: 2023-01-24
攻击模式描述
An adversary uses TCP ACK segments to gather information about firewall or ACL configuration. The purpose of this type of scan is to discover information about filter configurations rather than port state. This type of scanning is rarely useful alone, but when combined with SYN scanning, gives a more complete picture of the type of firewall rules that are present.
执行流程
步骤 1 Experiment
An adversary sends TCP packets with the ACK flag set and that are not associated with an existing connection to target ports.
步骤 2 Experiment
An adversary uses the response from the target to determine the port's state. If a RST packet is received the target port is either closed or the ACK was sent out-of-sync. If no response is received, the target is likely using a stateful firewall.
前提条件
- The adversary requires logical access to the target network. ACK scanning requires the use of raw sockets, and thus cannot be performed from some Windows systems (Windows XP SP 2, for example). On Unix and Linux, raw socket manipulations require root privileges.
所需资源
- This attack can be achieved via the use of a network mapper or scanner, or via raw socket programming in a scripting language. Packet injection tools are also useful for this purpose. Depending upon the method used it may be necessary to sniff the network in order to see the response.
后果影响
影响范围: Confidentiality
技术影响: Other
影响范围: Confidentiality Access Control Authorization
技术影响: Bypass Protection Mechanism