CAPEC-312

Active OS Fingerprinting

Low severityMedium likelihoodStandard pattern

An adversary engages in activity to detect the operating system or firmware version of a remote target by interrogating a device, server, or platform with a probe designed to solicit behavior that will reveal information about the operating systems or firmware in the environment. Operating System detection is possible because implementations of common protocols (Such as IP or TCP) differ in distinct ways. While the implementation differences are not sufficient to 'break' compatibility with the protocol the differences are detectable because the target will respond in unique ways to specific probing activity that breaks the semantic or logical rules of packet construction for a protocol. Different operating systems will have a unique response to the anomalous input, providing the basis to fingerprint the OS behavior. This type of OS fingerprinting can distinguish between operating system types and versions.

On this page

Ask an AI about this attack pattern
Prerequisites
Resources required
Consequences
Weaknesses it exploits
Related attack patterns

Ask an AI about this attack pattern

ChatGPT Claude Google AI Mode

Show the prompt

Explain the attack pattern CAPEC-312: Active OS Fingerprinting: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/312.html and https://cve.bz/cve/capec/312?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

Prerequisites

The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.

Resources required

Any type of active probing that involves non-standard packet headers requires the use of raw sockets, which is not available on particular operating systems (Microsoft Windows XP SP 2, for example). Raw socket manipulation on Unix/Linux requires root privileges.
A tool capable of sending and receiving packets from a remote system.

Consequences

What a successful attack can lead to
Impact	Affects	Note
Read Data	Confidentiality
Hide Activities	Confidentiality, Access Control, Authorization

Weaknesses it exploits

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Recent CVEs with these weaknesses

4.3CVE-2026-1249442026-11-10
Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160.
4.3CVE-2026-1249412026-11-10
Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
4.3CVE-2026-1249302026-11-10
Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
4.3CVE-2026-1249292026-11-10
Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
4.3CVE-2026-1249252026-11-10
Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160.
4.3CVE-2026-1249092026-11-10
Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
5.3CVE-2026-967692026-11-10
The Extend B2B - Companies and Users Management for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the register_company_api. This makes it possible for unaut…
7.5CVE-2026-636442026-11-09
bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, allowing an unauthenticated remote attacker to read sensitive files such as /etc/shadow and /root/.bash_history. Th…

The newest records naming one of them. Each weakness's page lists them all.

Part of: CAPEC-224 Fingerprinting
More specific patterns: CAPEC-317 IP ID Sequencing Probe
CAPEC-318 IP 'ID' Echoed Byte-Order Probe
CAPEC-319 IP (DF) 'Don't Fragment Bit' Echoing Probe
CAPEC-320 TCP Timestamp Probe
CAPEC-321 TCP Sequence Number Probe
CAPEC-322 TCP (ISN) Greatest Common Divisor Probe
CAPEC-323 TCP (ISN) Counter Rate Probe
CAPEC-324 TCP (ISN) Sequence Predictability Probe
CAPEC-325 TCP Congestion Control Flag (ECN) Probe
CAPEC-326 TCP Initial Window Size Probe
CAPEC-327 TCP Options Probe
CAPEC-328 TCP 'RST' Flag Checksum Probe
CAPEC-329 ICMP Error Message Quoting Probe
CAPEC-330 ICMP Error Message Echoing Integrity Probe
CAPEC-331 ICMP IP Total Length Field Probe
CAPEC-332 ICMP IP 'ID' Field Error Message Probe

MITRE's words, unchanged: CAPEC-312 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.