CAPEC-294 详情

An adversary sends an ICMP Type 17 Address Mask Request to gather information about a target's networking configuration. ICMP Address Mask Requests are defined by RFC-950, "Internet Standard Subnetting Procedure." An Address Mask Request is an ICMP type 17 message that triggers a remote system to respond with a list of its related subnets, as well as its default gateway and broadcast address via an ICMP type 18 Address Mask Reply datagram. Gathering this type of information helps the adversary plan router-based attacks as well as denial-of-service attacks against the broadcast address.

前提条件

The ability to send an ICMP type 17 query (Address Mask Request) to a remote target and receive an ICMP type 18 message (ICMP Address Mask Reply) in response. Generally, modern operating systems will ignore ICMP type 17 messages, however, routers will commonly respond to this request.

所需资源

The ability to send custom ICMP queries. This can be accomplished via the use of various scanners or utilities.

相关弱点

参考资料

REF-33

Hacking Exposed: Network Security Secrets & Solutions
Stuart McClure, Joel Scambray, George Kurtz.

REF-139

RFC950 - Internet Standard Subnetting Procedure
J. Mogul, J. Postel.
http://www.faqs.org/rfcs/rfc950.html

REF-123

RFC792 - Internet Control Messaging Protocol
J. Postel.
http://www.faqs.org/rfcs/rfc792.html

REF-125

Host Discovery with Nmap
Mark Wolfgang.
http://nmap.org/docs/discovery.pdf

REF-34

Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning
Gordon "Fyodor" Lyon.

提交记录

修改记录