CAPEC-305 Metadata
Likelihood of Attack
Low
Typical Severity
Low
Overview
Summary
An adversary uses TCP ACK segments to gather information about firewall or ACL configuration. The purpose of this type of scan is to discover information about filter configurations rather than port state. This type of scanning is rarely useful alone, but when combined with SYN scanning, gives a more complete picture of the type of firewall rules that are present.
Prerequisites
The adversary requires logical access to the target network. ACK scanning requires the use of raw sockets, and thus cannot be performed from some Windows systems (Windows XP SP 2, for example). On Unix and Linux, raw socket manipulations require root privileges.
Execution Flow
| Step | Phase | Description | Techniques |
|---|---|---|---|
| 1 | Experiment | An adversary sends TCP packets with the ACK flag set and that are not associated with an existing connection to target ports. |
|
| 2 | Experiment | An adversary uses the response from the target to determine the port's state. If a RST packet is received the target port is either closed or the ACK was sent out-of-sync. If no response is received, the target is likely using a stateful firewall. |
|
Potential Solutions / Mitigations
No specific solutions listed.
Related Weaknesses (CWE)
| CWE ID | Description |
|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor |
Related CAPECs
| CAPEC ID | Description |
|---|---|
| CAPEC-300 | An adversary uses a combination of techniques to determine the state of the ports on a remote target. Any service or application available for TCP or UDP networking will have a port open for communications over the network. |
Stay Ahead of Attack Patterns
Understanding CAPEC patterns helps security professionals anticipate and thwart potential attacks. Leverage these insights to enhance threat modeling, strengthen your software development lifecycle, and train your security teams effectively.