ICMP Fingerprinting Probes
Attack Pattern ID: 316 (Standard Attack Pattern)Typical Severity: LowStatus: Draft
+ Description

Summary

An attacker engages in ICMP stack fingerprinting techniques to determine the operating system type and version of a remote target. The role of ICMP as an ubiquitous diagnostic messaging protocol means that ICMP fingerprinting techniques are applicable to almost any internet host in a similar manner as TCP. ICMP fingerprinting techniques involve the generation of ICMP messages and analyzing the responses. This method is limited in that most firewalls are configured to block ICMP messages for security reasons, so it is most effective when used on an internal network segment. OS fingerprints using ICMP usually involve multiple different probes as the information returned from any one probe is usually insufficient to support a reliable OS inference.

+ Target Attack Surface

Target Attack Surface Description

Targeted OSI Layers: Network Layer

Target Attack Surface Localities

Server-side

Target Attack Surface Types: Host

Target Functional Services

Target Functional Service 1: None
Protocol 1: ICMP
Protocol Header 1
Protocol RFCProtocol Field NameProtocol Field DescriptionProtocol Operation CodeProtocol Data
RFC 792
Type
The ICMP Type Field determines the function of the ICMP query. A Type 8 message directs the target to reply to the sender of the echo request message with an echo reply message. In forming an echo reply the source and destination addresses are switched, the Type field is set to '0', any data contained in the data portion of the echo request is sent "echoed" back to the host, and the checksum is recalculated.
8
ICMP echo requests may contain arbitrary data as a payload. When the ICMP Type is 8 (echo request), the data received in the echo message must be returned in the echo reply message.
Related Protocol: Internet Protocol
Relationship Type
Uses Protocol
+ Attack Prerequisites

The ability to generate and analyze ICMP messages from a target. In cases where certain message types are blocked by a firewall, the reliability of ICMP fingerprinting declines sharply.

+ Related Attack Patterns
NatureTypeIDNameDescriptionView(s) this relationship pertains toView\(s\)
ChildOfAttack PatternAttack Pattern312Active OS Fingerprinting 
Mechanism of Attack (primary)1000
ParentOfAttack PatternAttack Pattern329ICMP Error Message Quoting Probe 
Mechanism of Attack (primary)1000
ParentOfAttack PatternAttack Pattern330ICMP Error Message Echoing Integrity Probe 
Mechanism of Attack (primary)1000
ParentOfAttack PatternAttack Pattern331ICMP IP Total Length Field Probe 
Mechanism of Attack (primary)1000
ParentOfAttack PatternAttack Pattern332ICMP IP 'ID' Field Error Message Probe 
Mechanism of Attack (primary)1000
+ References
Stuart McClure, Joel Scambray, George Kurtz. "Hacking Exposed: Network Security Secrets & Solutions". 6th Edition. McGraw Hill, ISBN: 978-0-07-161374-3. 2009.
Defense Advanced Research Projects Agency (DARPA). "RFC792 - Internet Control Messaging Protocol". 1981. <http://www.faqs.org/rfcs/rfc792.html>.
Defense Advanced Research Projects Agency (DARPA). "RFC1122 - Requirements for Internet Hosts - Communication Layers". 1981. <http://www.faqs.org/rfcs/rfc1122.html>.
Ofir Arkin, et.al. "A Remote Active OS Fingerprinting Tool using ICMP". 2008. <http://ofirarkin.files.wordpress.com/2008/11/login.pdf>.
Back to top