Attacker                                  Target
   │                                         │
   │──── ICMP Type 13 (Timestamp Request) ──▶│
   │                                         │  [host processes request]
   │◀─── ICMP Type 14 (Timestamp Reply) ─────│
   │                                         │
   Reply contains three 32-bit timestamp fields (ms since midnight UTC):
      ├── Originate Timestamp  (set by requester — often 0)
      ├── Receive Timestamp    ◀── server clock leaked here
      └── Transmit Timestamp   ◀── server clock leaked here

python3 --version   # must be 3.8+

git clone https://github.com/<your-username>/CVE-1999-0524-ICMP-Timestamp-Scanner.git
cd CVE-1999-0524-ICMP-Timestamp-Scanner
chmod +x icmp_timestamp_scan.py

sudo python3 icmp_timestamp_scan.py [OPTIONS]

Options:
  -t, --target    IP, comma-separated IPs, or CIDR  (terminal input)
  -f, --file      Path to file with one IP/CIDR per line
  --timeout SECS  Seconds to wait per host  (default: 2.0)
  --threads N     Concurrent threads        (default: 30)
  -v, --verbose   Show progress bar + full hex dump per host
  -h, --help      Show help

# Single host
sudo python3 icmp_timestamp_scan.py -t 192.168.1.1

# Multiple hosts
sudo python3 icmp_timestamp_scan.py -t 192.168.1.1,192.168.1.2,192.168.1.3

# CIDR subnet sweep
sudo python3 icmp_timestamp_scan.py -t 192.168.1.0/24

# From file
sudo python3 icmp_timestamp_scan.py -f hosts.txt

# Verbose — progress bar + full hex dump
sudo python3 icmp_timestamp_scan.py -f hosts.txt -v

# Fast wide scan
sudo python3 icmp_timestamp_scan.py -t 10.0.0.0/16 --threads 100 --timeout 1

# One IP or CIDR per line. Lines starting with # are ignored.
192.168.1.1
192.168.1.2
192.168.1.3
10.0.0.1
10.0.0.2
10.0.0.0/24

  [*] Targets  : 4 hosts
  [*] Timeout  : 2.0s  |  Threads: 30
  [*] Started  : 2026-07-14 06:37:25 UTC
  [*] Probe    : ICMP Type 13 (Timestamp Request)
  [*] Expect   : ICMP Type 14 (Timestamp Reply) from vulnerable hosts

╔══ VULNERABLE ══════════════════════════════════════════╗
║  Host       : 192.168.1.1
║  ICMP Type  : 14 — Timestamp Reply  (sent Type 13)
║  TTL        : 59
║  RTT        : 1.84 ms
║  ── Timestamps (ms since midnight UTC) ──────────────
║  Originate  :            0 ms  →  00:00:00.000 (not set)
║  Receive    :   22,974,518 ms  →  06:22:54.518 UTC
║  Transmit   :   22,974,518 ms  →  06:22:54.518 UTC  ← server time
║  ── Raw Response (hex) ──────────────────────────────
║  45 48 00 28 14 76 00 00 3b 01 2d 93 c0 a8 01 01 c0 a8 01 64 0e 00 f9 15 ...
║  Legend: ██=IP header  ██=ICMP header  ██=ICMP type14  ██=timestamps
╚════════════════════════════════════════════════════════╝

  [-] 192.168.1.2        no response (filtered or not vulnerable)

╔══ VULNERABLE ══════════════════════════════════════════╗
║  Host       : 192.168.1.3
║  TTL        : 59  |  RTT : 2.11 ms
║  Transmit   :   22,977,926 ms  →  06:22:57.926 UTC  ← server time
╚════════════════════════════════════════════════════════╝

══════════════════════════════════════════════════════════════════
  SCAN SUMMARY
══════════════════════════════════════════════════════════════════
  Scanner time  : 2026-07-14 13:37:25 WIB  (06:37:25 UTC)
  Total probed  : 4
  Vulnerable    : 2
  No response   : 2
  Errors        : 0

  ┌─ VULNERABLE HOSTS ────────────────────────────────────────────┐
  │  Host               TTL      RTT      Server Time (UTC)   Transmit ms │
  ├───────────────────────────────────────────────────────────────┤
  │  192.168.1.1         59    1.8ms   06:22:54.518 UTC    22,974,518  │
  │  192.168.1.3         59    2.1ms   06:22:57.926 UTC    22,977,926  │
  └───────────────────────────────────────────────────────────────┘

  ── Hex Evidence ─────────────────────────────────────────────

  [192.168.1.1]  TTL=59  RTT=1.84ms  Server→ 06:22:54.518 UTC
  45 48 00 28 14 76 00 00 3b 01 2d 93 c0 a8 01 01 c0 a8 01 64 0e 00 f9 15 ...
  Legend: ██=IP header  ██=ICMP header  ██=ICMP type14  ██=timestamps

  [192.168.1.3]  TTL=59  RTT=2.11ms  Server→ 06:22:57.926 UTC
  45 48 00 28 1a c3 00 00 3b 01 27 46 c0 a8 01 03 c0 a8 01 64 0e 00 f3 7e ...
  Legend: ██=IP header  ██=ICMP header  ██=ICMP type14  ██=timestamps

  Impact   : Information Disclosure — server time exposed
  CWE      : CWE-200 Exposure of Sensitive Information
  CVSS v3  : 0.0 (Low) — network access required
  Fix      : Block ICMP type 13 at perimeter ACL/firewall
  Cisco    : access-list <ACL> deny icmp any any 13

Byte   Field              Example      Description
─────  ─────────────────  ───────────  ──────────────────────────────────────
 0     IP Version/IHL     45           IPv4, header length = 20 bytes
 1     DSCP/ECN           48
 2-3   Total Length       0028         40 bytes
 4-5   Identification     1476
 6-7   Flags/Fragment     0000
 8     TTL                3b           59 hops
 9     Protocol           01           ICMP
10-11  IP Checksum        2d93
12-15  Source IP          c0a80101     192.168.1.1  ← responding host
16-19  Destination IP     c0a80164     192.168.1.100  ← scanner
──── ICMP header starts at byte 20 ────────────────────────────────────────
20     ICMP Type          0e           14 = Timestamp Reply  ← VULNERABLE
21     ICMP Code          00
22-23  ICMP Checksum      f915
24-25  Identifier         d5bf
26-27  Sequence Number    0001
28-31  Originate TS       00000000     0 ms (requester field, not filled)
32-35  Receive TS         015e9036     22,974,518 ms = 06:22:54 UTC  ← leaked
36-39  Transmit TS        015e9036     22,974,518 ms = 06:22:54 UTC  ← leaked

ip access-list extended BLOCK-ICMP-TS
 deny icmp any any 13
 deny icmp any any 17
 permit ip any any
!
interface GigabitEthernet0/0
 ip access-group BLOCK-ICMP-TS in

access-list OUTSIDE_IN deny icmp any any 13
access-list OUTSIDE_IN deny icmp any any 17
access-group OUTSIDE_IN in interface outside

iptables -A INPUT  -p icmp --icmp-type timestamp-request -j DROP
iptables -A OUTPUT -p icmp --icmp-type timestamp-reply   -j DROP

nft add rule inet filter input  icmp type timestamp-request drop
nft add rule inet filter output icmp type timestamp-reply   drop

netsh advfirewall firewall add rule `
  name="Block ICMP Timestamp Request" `
  protocol=icmpv4:13,any action=block dir=in