CAPEC-307
Alert dla konkretnego CAPEC
Bądź na bieżąco z wszelkimi zmianami dotyczącymi konkretnego CAPEC.
Opisy CAPEC
An adversary scans for RPC services listing on a Unix/Linux host.
Informacje CAPEC
Przebieg wykonania
1) Experiment
An adversary sends RCP packets to target ports.
2) Experiment
An adversary uses the response from the target to determine which, if any, RPC service is running on that port. Responses will vary based on which RPC service is running.
Wymagania wstępne
RPC scanning requires no special privileges when it is performed via a native system utility.Wymagane zasoby
The ability to craft custom RPC datagrams for use during network reconnaissance via native OS utilities or a port scanning tool. By tailoring the bytes injected one can scan for specific RPC-registered services. Depending upon the method used it may be necessary to sniff the network in order to see the response.Łagodzenie
Typically, an IDS/IPS system is very effective against this type of attack.Powiązane słabości
| Nazwa słabości | |
|---|---|
CWE-200 |
Exposure of Sensitive Information to an Unauthorized Actor The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Odniesienia
REF-33
Hacking Exposed: Network Security Secrets & SolutionsStuart McClure, Joel Scambray, George Kurtz.
REF-158
RFC768 - User Datagram ProtocolJ. Postel.
http://www.faqs.org/rfcs/rfc768.html
REF-34
Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security ScanningGordon "Fyodor" Lyon.
REF-130
The Art of Port ScanningGordon "Fyodor" Lyon.
http://phrack.org/issues/51/11.html
Zgłoszenie
| Nazwa | Organizacja | Data | Data wydania |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
Modyfikacje
| Nazwa | Organizacja | Data | Komentarz |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Description, Description Summary, References, Related_Weaknesses, Resources_Required, Solutions_and_Mitigations | |
| CAPEC Content Team | The MITRE Corporation | Updated Execution_Flow | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Extended_Description |
