| 名称 |
TCP Null Scan |
|
|
| 摘要 |
An adversary uses a TCP NULL scan to determine if ports are closed on the target machine. This scan type is accomplished by sending TCP segments with no flags in the packet header, generating packets that are illegal based on RFC 793. The RFC 793 expected behavior is that any TCP segment with an out-of-state Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be handled with a RST in response. This behavior should allow an attacker to scan for closed ports by sending certain types of rule-breaking packets (out of sync or disallowed by the TCB) and detect closed ports via RST packets. |
| 前置条件 |
The adversary requires logical access to the target network. NULL scanning requires the use of raw sockets, and thus cannot be performed from some Windows systems (Windows XP SP 2, for example). On Unix and Linux, raw socket manipulations require root privileges. |
| 执行流程 |
| 步骤 |
阶段 |
描述 |
技术手法 |
| 1 |
Experiment |
An adversary sends TCP packets with no flags set and that are not associated with an existing connection to target ports. |
|
| 2 |
Experiment |
An adversary uses the response from the target to determine the port's state. If no response is received the port is open. If a RST packet is received then the port is closed. |
|
|
| 解决方案 | Employ a robust network defensive posture that includes a managed IDS/IPS. |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-200 |
Exposure of Sensitive Information to an Unauthorized Actor |
|
| 关联 CAPEC |
|
CAPEC 编号
|
描述
|
| CAPEC-300 |
An adversary uses a combination of techniques to determine the state of the ports on a remote target. Any service or application available for TCP or UDP networking will have a port open for communications over the network. |
|