| 名称 |
UDP Scan |
|
|
| 摘要 |
An adversary engages in UDP scanning to gather information about UDP port status on the target system. UDP scanning methods involve sending a UDP datagram to the target port and looking for evidence that the port is closed. Open UDP ports usually do not respond to UDP datagrams as there is no stateful mechanism within the protocol that requires building or establishing a session. Responses to UDP datagrams are therefore application specific and cannot be relied upon as a method of detecting an open port. UDP scanning relies heavily upon ICMP diagnostic messages in order to determine the status of a remote port. |
| 前置条件 |
The ability to send UDP datagrams to a host and receive ICMP error messages from that host. In cases where particular types of ICMP messaging is disallowed, the reliability of UDP scanning drops off sharply. |
| 执行流程 |
| 步骤 |
阶段 |
描述 |
技术手法 |
| 1 |
Experiment |
An adversary sends UDP packets to target ports. |
|
| 2 |
Experiment |
An adversary uses the response from the target to determine the port's state. Whether a port responds to a UDP packet is dependant on what application is listening on that port. No response does not indicate the port is not open. |
|
|
| 解决方案 | Firewalls or ACLs which block egress ICMP error types effectively prevent UDP scans from returning any useful information. UDP scanning is complicated by rate limiting mechanisms governing ICMP error messages. |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-200 |
Exposure of Sensitive Information to an Unauthorized Actor |
|
| 关联 CAPEC |
|
CAPEC 编号
|
描述
|
| CAPEC-300 |
An adversary uses a combination of techniques to determine the state of the ports on a remote target. Any service or application available for TCP or UDP networking will have a port open for communications over the network. |
|