System and method for network vulnerability detection and reporting
View Patent ↗A system and method provide comprehensive and highly automated testing of vulnerabilities to intrusion on a target network, including identification of operating system, identification of target network topology and target computers, identification of open target ports, assessment of vulnerabilities on target ports, active assessment of vulnerabilities based on information acquired from target computers, quantitative assessment of target network security and vulnerability, and hierarchical graphical representation of the target network, target computers, and vulnerabilities in a test report. The system and method employ minimally obtrusive techniques to avoid interference with or damage to the target network during or after testing.
1. A system for determining an operating system of a target computer operably connected to a network, the system comprising:
first and second data packets, said first and second data packets compliant with a protocol supported by said network, said first and second data packets transmitted via said network to said target computer;
first and second operating system fingerprints comprising data bits stored in a computer-readable medium, said first and second operating system fingerprints associated with a first operating system;
a first target computer fingerprint comprising data bits stored in a computer-readable medium, said first target computer fingerprint including a representation of at least a portion of data received in response to said transmission of said first data packet;
a second target computer fingerprint comprising data bits stored in a computer-readable medium, said second target computer fingerprint including a representation of at least a portion of data received in response to said transmission of said second data packet; and
fingerprint comparison instructions embodied in a computer readable storage medium, said instructions executable by a computer to compare said first operating system fingerprint and said first target computer fingerprint, to compare said second operating system fingerprint and said second target computer fingerprint, and to generate a result indicative of whether said first operating system was running on said target computer;
wherein the first and second data packets each include TCP packets.
2. The system as described in claim 1 , wherein a first range of bits of said first data packet represents a first parameter value, and wherein said first range of bits of said second data packet represents a second parameter value different from said first parameter value.
3. The system as described in claim 2 , wherein said second parameter value is derived by changing one bit in said first range of bits of said first data packet.
4. The system as described in claim 2 , wherein said first and second operating system fingerprints differ.
5. The system as described in claim 4 , further comprising:
a third data packet, said third data packet compliant with said protocol, said first range of bits of said third data packet representing a third parameter value different from said first and second parameter values, said third data packet transmitted via said network to said target computer;
a third operating system fingerprint comprising clara bits stored in a computer-readable medium, said third operating system fingerprint associated with said first operating system, said third operating system fingerprint differing from said first and second operating system fingerprints; and
a third target computer fingerprint comprising data bits stored in a computer-readable medium, said third target computer fingerprint including a representation of at least a portion of data received in response to said transmission of said first data packet, said comparison instructions executable by a computer to compare said third operating system fingerprint and said third target computer fingerprint before generating said result.
6. The system as described in claim 5 , further comprising:
fourth, fifth and sixth operating system fingerprints comprising data bits stored in a computer-readable medium, said fourth, fifth and sixth operating system fingerprints associated with a second operating system, at least one of said fourth, fifth and sixth operating system fingerprints differing from a respective one of said first, second and third operating system fingerprints;
said comparison instructions executable by a computer to compare said fourth operating system fingerprint and said first target computer fingerprint, to compare said fifth operating system fingerprint and said second target computer fingerprint, to compare said sixth operating system fingerprint and said third target computer fingerprint, and to generate a second result indicative of whether said second operating system was running on said target computer.
7. The system as described in claim 5 , wherein said protocol is TCP/IP and wherein said first range of bits corresponds to a packet field representing a maximum segment size.
8. The system as described in claim 5 , wherein said first parameter value is obtained by setting no bits, said second parameter value is obtained by setting one bit, and said third parameter value is obtained by setting two bits.
9. The system as described in claim 5 , wherein said first parameter value is 0, said second parameter value is 128, and said third parameter value is 128 plus a multiple of 256.
10. The system as described in claim 5 , wherein said first range of bits represents at least two bytes, and wherein a value of said second parameter is obtained by setting the last bit in a byte, and a value for said third parameter is obtained by setting the last bit in a byte.
11. The system as described in claim 10 , wherein said third parameter is obtained by setting adjacent bits in said first range of bits.
12. The system as described in claim 5 , wherein said first, second and third data packets are transmitted in order of lowest parameter value first.
13. A method for identifying an operating system of a target computer via a network, the method comprising the steps of:
sending a first data packet to said target computer via said network, said first data packet complying with a protocol of said network and having a first pattern of bits in a first range of bits;
generating a first response value representing at least a portion of data received via said network in response to said sending of said first data packet;
sending a second data packet to said target computer via said network, said second data packet complying with said protocol and having a second pattern of bits in a first range of bits, said second pattern of bits different from said fir St pattern;
generating a second response value representing at least a portion of data received via said network in response to said sending of said second data packet;
sending a third data packet to said target computer via said network, said third data packet complying with said protocol and having a third pattern of bits in a first range of bits, said third pattern of bits different from said first or said second pattern;
generating a third response value representing at least a portion of data received via said network in response to said sending of said third data packet;
comparing said first response value to a first predetermined value associated with a first operating system;
comparing said second response value to a second predetermined value associated with said first operating system;
comparing said third response value to a third predetermined value associated with said first operating system; and
generating a value indicative of a relationship between said first operating system and said target computer;
wherein the first, second, and third data packets each include TCP packets.
14. The method as described in claim 13 , the method comprising the further steps of:
comparing said first response value to a fourth predetermined value associated with a second operating system;
comparing said second response value to a fifth predetermined value associated with said second operating system; and
comparing said third response value to a sixth predetermined value associated with said second operating system.
15. The method as described in claim 13 , wherein no bit is set in said first pattern of bits, wherein one bit is set in said second pattern of bits, and wherein two bits are set in said third pattern of bits.
16. The method as described in claim 13 , wherein the number of bytes in said second pattern of bits that have at least one bit set is greater than the number of bytes in said first pattern of bits that have at least one bit set, and wherein the number of bytes in said third pattern of bits that have at least one bit set is greater than the number of bytes in said second pattern of bits that have at least one bit set.
17. The method as described in claim 13 , wherein no byte in said first pattern of bits has a least significant bit or a most significant bit that is set wherein at least one byte in said second pattern of bits has a most significant bit that is set, and wherein at least one byte in said third pattern of bits has a least significant bit that is set.
18. The system as described in claim 5 , wherein the third data packet includes an RFC-compliant TCP packet.
19. The system as described in claim 1 , wherein the first data packet includes a TCP SYN packet with a maximum segment size MSS option in an options field thereof set to 0.
20. The system as described in claim 1 , wherein the first data packet includes a TCP SYN packet with a maximum segment size MSS option in an options field thereof set to 128.