I am interested in how attackers manage to identify vulnerable versions of software on client machines, behind a large network or stand alone at home. I am not interested in portscanning at all, as the majority of software on a client machine will not be actively listening.
I am specifically interested in techniques to determine versions of vulnerable software on a client machine. For example, a given machine may have Adobe Reader and Flash, Windows Media Player, VLC and Java installed. It may be that all of these apps were vulnerable, or only one.
I would imagine it would be advantageous to an attacker to be able to determine which if any application was vulnerable, as launching attacks may alert the user and so I wonder how attackers may accomplish this.
I thought I recalled a scenario in which using a browser exploit the attacker was able to read file information from the local file system, which would do the trick.
What other avenues of attack could be used to gain this information directly or indirectly?
Could network management software which reports software versions be used maliciously? If so, what would be an example scenario?
In many cases of reported attacks a specific vulnerability was used, out of all the possibilities. I don't think attackers were that lucky as spamming a hundred attacks would raise attention and perhaps be picked up.
I would think there is some methodology for detecting various versions of software, perhaps without detection. This would also be true for drive by download attacks....where there may be 30 different attacks but instead of the page simply loading all and trying its luck can load an appropriate attack. Or, is it actually more common for such sites to spam as many attacks as they can without caring if media players and pdf readers randomly open and display an error on the client machine?
Any insight or sources on this are much appreciated.