Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CAPEC-306:TCP Window Scan
Attack Pattern ID:306
Version:v3.9
Attack Pattern Name:TCP Window Scan
Abstraction:Detailed
Status:Stable
Likelihood of Attack:
Typical Severity:Low
DetailsContent HistoryRelated WeaknessesReports
▼Description
An adversary engages in TCP Window scanning to analyze port status and operating system type. TCP Window scanning uses the ACK scanning method but examine the TCP Window Size field of response RST packets to make certain inferences. While TCP Window Scans are fast and relatively stealthy, they work against fewer TCP stack implementations than any other type of scan. Some operating systems return a positive TCP window size when a RST packet is sent from an open port, and a negative value when the RST originates from a closed port. TCP Window scanning is one of the most complex scan types, and its results are difficult to interpret. Window scanning alone rarely yields useful information, but when combined with other types of scanning is more useful. It is a generally more reliable means of making inference about operating system versions than port status.
▼Extended Description
▼Alternate Terms
▼Relationships
NatureTypeIDName
ChildOfS300Port Scanning
Nature: ChildOf
Type: Standard
ID: 300
Name: Port Scanning
▼Execution Flow
Experiment
1.

An adversary sends TCP packets with the ACK flag set and that are not associated with an existing connection to target ports.

An adversary sends TCP packets with the ACK flag set and that are not associated with an existing connection to target ports.

Technique
2.

An adversary uses the response from the target to determine the port's state. Specifically, the adversary views the TCP window size from the returned RST packet if one was received. Depending on the target operating system, a positive window size may indicate an open port while a negative window size may indicate a closed port.

An adversary uses the response from the target to determine the port's state. Specifically, the adversary views the TCP window size from the returned RST packet if one was received. Depending on the target operating system, a positive window size may indicate an open port while a negative window size may indicate a closed port.

Technique
▼Prerequisites
TCP Window scanning requires the use of raw sockets, and thus cannot be performed from some Windows systems (Windows XP SP 2, for example). On Unix and Linux, raw socket manipulations require root privileges.
▼Skills Required
▼Resources Required
The ability to send TCP segments with a custom window size to a host during network reconnaissance. This can be achieved via the use of a network mapper or scanner, or via raw socket programming in a scripting language. Packet injection tools are also useful for this purpose. Depending upon the method used it may be necessary to sniff the network in order to see the response.
▼Indicators
▼Consequences
ScopeLikelihoodImpactNote
ConfidentialityN/AOtherN/A
ConfidentialityAccess ControlAuthorizationN/ABypass Protection MechanismHide ActivitiesN/A
Scope: Confidentiality
Likelihood: N/A
Impact: Other
Note: N/A
Scope: Confidentiality, Access Control, Authorization
Likelihood: N/A
Impact: Bypass Protection Mechanism, Hide Activities
Note: N/A
▼Mitigations
▼Example Instances
▼Related Weaknesses
IDName
CWE-200Exposure of Sensitive Information to an Unauthorized Actor
ID: CWE-200
Name: Exposure of Sensitive Information to an Unauthorized Actor
▼Taxonomy Mappings
Taxonomy NameEntry IDEntry Name
▼Notes
▼References
Reference ID: REF-33
Title: Hacking Exposed: Network Security Secrets & Solutions
Author: Stuart McClure, Joel Scambray, George Kurtz
Publication:
Publisher:McGraw Hill
Edition:6th Edition
URL:
URL Date:
Day:N/A
Month:N/A
Year:2009
Reference ID: REF-34
Title: Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning
Author: Gordon "Fyodor" Lyon
Publication:
Publisher:Insecure.com LLC, ISBN: 978-0-9799587-1-7
Edition:3rd "Zero Day" Edition,
URL:
URL Date:
Day:N/A
Month:N/A
Year:2008
Reference ID: REF-128
Title: RFC793 - Transmission Control Protocol
Author: Defense Advanced Research Projects Agency Information Processing Techniques Office, Information Sciences Institute University of Southern California
Publication:
Publisher:Defense Advanced Research Projects Agency (DARPA)
Edition:
URL:http://www.faqs.org/rfcs/rfc793.html
URL Date:
Day:N/A
Month:09
Year:1981
Reference ID: REF-130
Title: The Art of Port Scanning
Author: Gordon "Fyodor" Lyon
Publication:
Phrack Magazine
Publisher:
Edition:Volume: 7, Issue. 51
URL:http://phrack.org/issues/51/11.html
URL Date:
Day:N/A
Month:N/A
Year:1997
Details not found