CAPEC-306: TCP Window Scan

MITRE classification

Overview

CAPEC-306 (TCP Window Scan) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.

How the attack works

The phases an attacker typically follows to carry out this attack.

Step 1
Experiment
An adversary sends TCP packets with the ACK flag set and that are not associated with an existing connection to target ports.
Step 2
Experiment
An adversary uses the response from the target to determine the port's state. Specifically, the adversary views the TCP window size from the returned RST packet if one was received. Depending on the target operating system, a positive window size may indicate an open port while a negative window size may indicate a closed port.

What the attacker needs

Prerequisites

TCP Window scanning requires the use of raw sockets, and thus cannot be performed from some Windows systems (Windows XP SP 2, for example). On Unix and Linux, raw socket manipulations require root privileges.

Resources required

The ability to send TCP segments with a custom window size to a host during network reconnaissance. This can be achieved via the use of a network mapper or scanner, or via raw socket programming in a scripting language. Packet injection tools are also useful for this purpose. Depending upon the method used it may be necessary to sniff the network in order to see the response.

Consequences

What a successful CAPEC-306 attack can achieve.

Other

Affects: Confidentiality

Bypass Protection Mechanism, Hide Activities

Affects: Confidentiality, Access Control, Authorization

Frequently asked questions

Common questions about CAPEC-306.

What is CAPEC-306?

An adversary engages in TCP Window scanning to analyze port status and operating system type. TCP Window scanning uses the ACK scanning method but examine the TCP Window Size field of response RST packets to make certain inferences. While TCP Window Scans are fast and relatively stealthy, they work against fewer TCP stack implementations than any other type of scan. Some operating systems return a positive TCP window size when a RST packet is sent from an open port, and a negative value when the RST originates from a closed port. TCP Window scanning is one of the most complex scan types, and its results are difficult to interpret. Window scanning alone rarely yields useful information, but when combined with other types of scanning is more useful. It is a generally more reliable means of making inference about operating system versions than port status.

How does a TCP Window Scan attack work?

It typically unfolds over 2 phases. It begins with: An adversary sends TCP packets with the ACK flag set and that are not associated with an existing connection to target ports.

What weaknesses does CAPEC-306 target?

CAPEC-306 exploits 1 CWE weakness, including CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

How severe is CAPEC-306?

MITRE rates CAPEC-306 as Low severity.

References

Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.

Defend against CAPEC-306

Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.

Start free See pricing