{"1": {"name": "Accessing Functionality Not Properly Constrained by ACLs", "abstraction": "Standard", "status": "Draft", "description": "In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive informatio...", "likelihood": "High", "severity": "High", "prerequisites": ["The application must be navigable in a manner that associates elements (subsections) of the application with ACLs.", "The various resources, or individual URLs, must be somehow discoverable by the attacker", "The administrator must have forgotten to associate an ACL or has associated an inappropriately permissive ACL with a particular navigable resource."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey] The attacker surveys the target application, possibly as a valid and authenticated user"}, {"step": "2", "phase": "Explore", "description": "[Identify Functionality] At each step, the attacker notes the resource or functionality access mechanism invoked upon performing specific actions"}, {"step": "3", "phase": "Experiment", "description": "[Iterate over access capabilities] Possibly as a valid user, the attacker then tries to access each of the noted access mechanisms directly in order to perform functions not constrained by the ACLs."}], "related_cwes": ["CWE-276", "CWE-285", "CWE-434", "CWE-693", "CWE-732", "CWE-1191", "CWE-1193", "CWE-1220", "CWE-1297", "CWE-1311", "CWE-1314", "CWE-1315", "CWE-1318", "CWE-1320", "CWE-1321", "CWE-1327"]}, "10": {"name": "Buffer Overflow via Environment Variables", "abstraction": "Detailed", "status": "Draft", "description": "This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the adversary finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.", "likelihood": "High", "severity": "High", "prerequisites": ["The application uses environment variables.", "An environment variable exposed to the user is vulnerable to a buffer overflow.", "The vulnerable environment variable uses untrusted data.", "Tainted data used in the environment variables is not properly validated. For instance boundary checking is not done before copying the input data to a buffer."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target application] The adversary identifies a target application or program to perform the buffer overflow on. In this attack the adversary looks for an application that loads the content o..."}, {"step": "2", "phase": "Experiment", "description": "[Find injection vector] The adversary identifies an injection vector to deliver the excessive content to the targeted application's buffer."}, {"step": "3", "phase": "Experiment", "description": "[Craft overflow content] The adversary crafts the content to be injected. If the intent is to simply cause the software to crash, the content need only consist of an excessive quantity of random data...."}, {"step": "4", "phase": "Exploit", "description": "[Overflow the buffer] Using the injection vector, the adversary injects the crafted overflow content into the buffer."}], "related_cwes": ["CWE-120", "CWE-302", "CWE-118", "CWE-119", "CWE-74", "CWE-99", "CWE-20", "CWE-680", "CWE-733", "CWE-697"]}, "100": {"name": "Overflow Buffers", "abstraction": "Standard", "status": "Draft", "description": "Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an adversary. As a consequence, an adversary is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the adversaries' choice.", "likelihood": "High", "severity": "Very High", "prerequisites": ["Targeted software performs buffer operations.", "Targeted software inadequately performs bounds-checking on buffer operations.", "Adversary has the capability to influence the input to buffer operations."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target application] The adversary identifies a target application or program to perform the buffer overflow on. Adversaries often look for applications that accept user input and that perfor..."}, {"step": "2", "phase": "Experiment", "description": "[Find injection vector] The adversary identifies an injection vector to deliver the excessive content to the targeted application's buffer."}, {"step": "3", "phase": "Experiment", "description": "[Craft overflow content] The adversary crafts the content to be injected. If the intent is to simply cause the software to crash, the content need only consist of an excessive quantity of random data...."}, {"step": "4", "phase": "Exploit", "description": "[Overflow the buffer] Using the injection vector, the adversary injects the crafted overflow content into the buffer."}], "examples": ["The most straightforward example is an application that reads in input from the user and stores it in an internal buffer but does not check that the size of the input data is less than or equal to the size of the buffer. If the user enters excessive length data, the buffer may overflow leading to th...", "Many web servers enforce security in web applications through the use of filter plugins. An example is the SiteMinder plugin used for authentication. An overflow in such a plugin, possibly through a long URL or redirect parameter, can allow an adversary not only to bypass the security checks but als..."], "related_cwes": ["CWE-120", "CWE-119", "CWE-131", "CWE-129", "CWE-805", "CWE-680"]}, "101": {"name": "Server Side Include (SSI) Injection", "abstraction": "Detailed", "status": "Draft", "description": "An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and...", "likelihood": "High", "severity": "High", "prerequisites": ["A web server that supports server side includes and has them enabled", "User controllable input that can carry include directives to the web server"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine applicability] The adversary determines whether server side includes are enabled on the target web server."}, {"step": "2", "phase": "Experiment", "description": "[Find Injection Point] Look for user controllable input, including HTTP headers, that can carry server side include directives to the web server."}, {"step": "3", "phase": "Exploit", "description": "[Inject SSI] Using the found injection point, the adversary sends arbitrary code to be inlcuded by the application on the server side. They may then need to view a particular page in order to have the..."}], "related_cwes": ["CWE-97", "CWE-74", "CWE-20"]}, "102": {"name": "Session Sidejacking", "abstraction": "Detailed", "status": "Draft", "description": "Session sidejacking takes advantage of an unencrypted communication channel between a victim and target system. The attacker sniffs traffic on a network looking for session tokens in unencrypted traffic. Once a session token is captured, the attacker performs malicious actions by using the stolen token with the targeted application to impersonate the victim. This attack is a specific method of session hijacking, which is exploiting a valid session token to gain unauthorized access to a target sy...", "likelihood": "High", "severity": "High", "prerequisites": ["An attacker and the victim are both using the same WiFi network.", "The victim has an active session with a target system.", "The victim is not using a secure channel to communicate with the target system (e.g. SSL, VPN, etc.)", "The victim initiated communication with a target system that requires transfer of the session token or the target application uses AJAX and thereby periodically \"rings home\" asynchronously using the s..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Detect Unprotected Session Token Transfer] The attacker sniffs on the wireless network to detect unencrypted traffic that contains session tokens."}, {"step": "2", "phase": "Experiment", "description": "[Capture session token] The attacker uses sniffing tools to capture a session token from traffic."}, {"step": "3", "phase": "Experiment", "description": "[Insert captured session token] The attacker attempts to insert a captured session token into communication with the targeted application to confirm viability for exploitation."}, {"step": "4", "phase": "Exploit", "description": "[Session Token Exploitation] The attacker leverages the captured session token to interact with the targeted application in a malicious fashion, impersonating the victim."}], "examples": ["The attacker and the victim are using the same WiFi public hotspot. When the victim connects to the hotspot, they has a hosted e-mail account open. This e-mail account uses AJAX on the client side which periodically asynchronously connects to the server side and transfers, amongst other things, the ..."], "related_cwes": ["CWE-294", "CWE-522", "CWE-523", "CWE-319", "CWE-614"]}, "103": {"name": "Clickjacking", "abstraction": "Standard", "status": "Draft", "description": "An adversary tricks a victim into unknowingly initiating some action in one system while interacting with the UI from a seemingly completely different, usually an adversary controlled or intended, system.", "likelihood": "Medium", "severity": "High", "prerequisites": ["The victim is communicating with the target application via a web based UI and not a thick client", "The victim's browser security policies allow at least one of the following JavaScript, Flash, iFrames, ActiveX, or CSS.", "The victim uses a modern browser that supports UI elements like clickable buttons (i.e. not using an old text only browser)", "The victim has an active session with the target system.", "The target system's interaction window is open in the victim's browser and supports the ability for initiating sensitive actions on behalf of the user in the target system"], "execution_flow": [{"step": "1", "phase": "Experiment", "description": "[Craft a clickjacking page] The adversary utilizes web page layering techniques to try to craft a malicious clickjacking page"}, {"step": "2", "phase": "Exploit", "description": "[Adversary lures victim to clickjacking page] Adversary utilizes some form of temptation, misdirection or coercion to lure the victim to loading and interacting with the clickjacking page in a way tha..."}, {"step": "3", "phase": "Exploit", "description": "[Trick victim into interacting with the clickjacking page in the desired manner] The adversary tricks the victim into clicking on the areas of the UI which contain the hidden action controls and there..."}], "related_cwes": ["CWE-1021"]}, "104": {"name": "Cross Zone Scripting", "abstraction": "Standard", "status": "Draft", "description": "An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security.", "likelihood": "Medium", "severity": "High", "prerequisites": ["The target must be using a zone-aware browser."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find systems susceptible to the attack] Find systems that contain functionality that is accessed from both the internet zone and the local zone. There needs to be a way to supply input to that functi..."}, {"step": "2", "phase": "Experiment", "description": "[Find the insertion point for the payload] The attacker first needs to find some system functionality or possibly another weakness in the system (e.g. susceptibility to cross site scripting) that woul..."}, {"step": "3", "phase": "Exploit", "description": "[Craft and inject the payload] Develop the payload to be executed in the higher privileged zone in the user's browser. Inject the payload and attempt to lure the victim (if possible) into executing th..."}], "examples": ["There was a cross zone scripting vulnerability discovered in Skype that allowed one user to upload a video with a maliciously crafted title that contains a script. Subsequently, when the victim attempts to use the \"add video to chat\" feature on attacker's video, the script embedded in the title of t..."], "related_cwes": ["CWE-250", "CWE-638", "CWE-285", "CWE-116", "CWE-20"]}, "105": {"name": "HTTP Request Splitting", "abstraction": "Detailed", "status": "Stable", "likelihood": "Medium", "severity": "High", "prerequisites": ["An additional intermediary HTTP agent such as an application firewall or a web caching proxy between the adversary and the second agent such as a web server, that sends multiple HTTP messages over sam...", "Differences in the way the two HTTP agents parse and interpret HTTP requests and its headers.", "HTTP headers capable of being user-manipulated.", "HTTP agents running on HTTP/1.0 or HTTP/1.1 that allow for Keep Alive mode, Pipelined queries, and Chunked queries and responses."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey network to identify target] The adversary performs network reconnaissance by monitoring relevant traffic to identify the network path and parsing of the HTTP messages with the goal of identify..."}, {"step": "1", "phase": "Experiment", "description": "[Identify vulnerabilities in targeted HTTP infrastructure and technologies] The adversary sends a variety of benign/ambiguous HTTP requests to observe responses from HTTP infrastructure in order to id..."}, {"step": "2", "phase": "Experiment", "description": "[Cause differential HTTP responses by experimenting with identified HTTP Request vulnerabilities] The adversary sends maliciously crafted HTTP requests with custom strings and embedded web scripts and..."}, {"step": "1", "phase": "Exploit", "description": "[Perform HTTP Request Splitting attack] Using knowledge discovered in the experiment section above, smuggle a message to cause one of the consequences."}], "related_cwes": ["CWE-74", "CWE-113", "CWE-138", "CWE-436"]}, "106": {"name": "DEPRECATED: XSS through Log Files", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated as it referes to an existing chain relationship between \"CAPEC-93 : Log Injection-Tampering-Forging\" and \"CAPEC-63 : Cross-Site Scripting\". Please refer to these CAPECs going forward."}, "107": {"name": "Cross Site Tracing", "abstraction": "Detailed", "status": "Draft", "description": "Cross Site Tracing (XST) enables an adversary to steal the victim's session cookie and possibly other authentication credentials transmitted in the header of the HTTP request when the victim's browser communicates to a destination system's web server.", "likelihood": "Medium", "severity": "Very High", "prerequisites": ["HTTP TRACE is enabled on the web server", "The destination system is susceptible to XSS or an adversary can leverage some other weakness to bypass the same origin policy", "Scripting is enabled in the client's browser", "HTTP is used as the communication protocol between the server and the client"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine if HTTP Trace is enabled] Determine if HTTP Trace is enabled at the web server with which the victim has an active session"}, {"step": "2", "phase": "Experiment", "description": "[Identify mechanism to launch HTTP Trace request] The adversary attempts to force the victim to issue an HTTP Trace request to the targeted application."}, {"step": "3", "phase": "Exploit", "description": "[Create a malicious script that pings the web server with HTTP TRACE request] The adversary creates a malicious script that will induce the victim's browser to issue an HTTP TRACE request to the desti..."}, {"step": "4", "phase": "Exploit", "description": "[Execute malicious HTTP Trace launching script] The adversary leverages an XSS vulnerability to force the victim to execute the malicious HTTP Trace launching script"}, {"step": "5", "phase": "Exploit", "description": "[Intercept HTTP TRACE response] The adversary's script intercepts the HTTP TRACE response from teh web server, glance sensitive information from it, and forward that information to a server controlled..."}], "related_cwes": ["CWE-693", "CWE-648"]}, "108": {"name": "Command Line Execution through SQL Injection", "abstraction": "Detailed", "status": "Draft", "description": "An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments with...", "likelihood": "Low", "severity": "Very High", "prerequisites": ["The application does not properly validate data before storing in the database", "Backend application implicitly trusts the data stored in the database", "Malicious data is used on the backend as a command line argument"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Probe for SQL Injection vulnerability] The attacker injects SQL syntax into user-controllable data inputs to search unfiltered execution of the SQL syntax in a query."}, {"step": "2", "phase": "Exploit", "description": "[Achieve arbitrary command execution through SQL Injection with the MSSQL_xp_cmdshell directive] The attacker leverages a SQL Injection attack to inject shell code to be executed by leveraging the xp_..."}, {"step": "3", "phase": "Exploit", "description": "[Inject malicious data in the database] Leverage SQL injection to inject data in the database that could later be used to achieve command injection if ever used as a command line argument"}, {"step": "4", "phase": "Exploit", "description": "[Trigger command line execution with injected arguments] The attacker causes execution of command line functionality which leverages previously injected database content as arguments."}], "related_cwes": ["CWE-89", "CWE-74", "CWE-20", "CWE-78", "CWE-114"]}, "109": {"name": "Object Relational Mapping Injection", "abstraction": "Detailed", "status": "Draft", "description": "An attacker leverages a weakness present in the database access layer code generated with an Object Relational Mapping (ORM) tool or a weakness in the way that a developer used a persistence framework to inject their own SQL commands to be executed against the underlying database. The attack here is similar to plain SQL injection, except that the application does not use JDBC to directly talk to the database, but instead it uses a data access layer generated by an ORM tool or framework (e.g. Hib...", "likelihood": "Low", "severity": "High", "prerequisites": ["An application uses data access layer generated by an ORM tool or framework", "An application uses user supplied data in queries executed against the database", "The separation between data plane and control plane is not ensured, through either developer error or an underlying weakness in the data access layer code generation framework"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine Persistence Framework Used] An attacker tries to determine what persistence framework is used by the application in order to leverage a weakness in the generated data access layer code or a..."}, {"step": "2", "phase": "Explore", "description": "[Probe for ORM Injection vulnerabilities] The attacker injects ORM syntax into user-controllable data inputs of the application to determine if it is possible modify data query structure and content."}, {"step": "3", "phase": "Exploit", "description": "[Perform SQL Injection through the generated data access layer] An attacker proceeds to exploit a weakness in the generated data access methods that does not properly separate control plane from the d..."}], "examples": ["When using Hibernate, it is possible to use the session.find() method to run queries against the database. This is an overloaded method that provides facilities to perform binding between the supplied user data and place holders in the statically defined query. However, it is also possible to use th..."], "related_cwes": ["CWE-20", "CWE-89", "CWE-564"]}, "11": {"name": "Cause Web Server Misclassification", "abstraction": "Detailed", "status": "Draft", "description": "An attack of this type exploits a Web server's decision to take action based on filename or file extension. Because different file types are handled by different server processes, misclassification may force the Web server to take unexpected action, or expected actions in an unexpected sequence. This may cause the server to exhaust resources, supply debug or system data to the attacker, or bind an attacker to a remote process.", "likelihood": "Medium", "severity": "High", "prerequisites": ["Web server software must rely on file name or file extension for processing.", "The attacker must be able to make HTTP requests to the web server."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Footprint file input vectors] Manually or using an automated tool, an attacker searches for all input locations where a user has control over the filenames or MIME types of files submitted to the web..."}, {"step": "2", "phase": "Experiment", "description": "[File misclassification shotgunning] An attacker makes changes to file extensions and MIME types typically processed by web servers and looks for abnormal behavior."}, {"step": "3", "phase": "Experiment", "description": "[File misclassification sniping] Understanding how certain file types are processed by web servers, an attacker crafts varying file payloads and modifies their file extension or MIME type to be that o..."}, {"step": "4", "phase": "Exploit", "description": "[Disclose information] The attacker, by manipulating a file extension or MIME type is able to make the web server return raw information (not executed)."}], "related_cwes": ["CWE-430"]}, "110": {"name": "SQL Injection through SOAP Parameter Tampering", "abstraction": "Detailed", "status": "Draft", "description": "An attacker modifies the parameters of the SOAP message that is sent from the service consumer to the service provider to initiate a SQL injection attack. On the service provider side, the SOAP message is parsed and parameters are not properly validated before being used to access a database in a way that does not use parameter binding, thus enabling the attacker to control the structure of the executed SQL query. This pattern describes a SQL injection attack with the delivery mechanism being a ...", "likelihood": "High", "severity": "Very High", "prerequisites": ["SOAP messages are used as a communication mechanism in the system", "SOAP parameters are not properly validated at the service provider", "The service provider does not properly utilize parameter binding when building SQL queries"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Detect Incorrect SOAP Parameter Handling] The attacker tampers with the SOAP message parameters and looks for indications that the tampering caused a change in behavior of the targeted application."}, {"step": "2", "phase": "Experiment", "description": "[Probe for SQL Injection vulnerability] The attacker injects SQL syntax into vulnerable SOAP parameters identified during the Explore phase to search for unfiltered execution of the SQL syntax in a qu..."}, {"step": "3", "phase": "Exploit", "description": "[Inject SQL via SOAP Parameters] The attacker injects SQL via SOAP parameters identified as vulnerable during Explore phase to launch a first or second order SQL injection attack."}], "examples": ["An attacker uses a travel booking system that leverages SOAP communication between the client and the travel booking service. An attacker begins to tamper with the outgoing SOAP messages by modifying their parameters to include characters that would break a dynamically constructed SQL query. They no..."], "related_cwes": ["CWE-89", "CWE-20"]}, "111": {"name": "JSON Hijacking (aka JavaScript Hijacking)", "abstraction": "Standard", "status": "Draft", "description": "An attacker targets a system that uses JavaScript Object Notation (JSON) as a transport mechanism between the client and the server (common in Web 2.0 systems using AJAX) to steal possibly confidential information transmitted from the server back to the client inside the JSON object by taking advantage of the loophole in the browser's Same Origin Policy that does not prohibit JavaScript from one website to be included and executed in the context of another website.", "likelihood": "High", "severity": "High", "prerequisites": ["JSON is used as a transport mechanism between the client and the server", "The target server cannot differentiate real requests from forged requests", "The JSON object returned from the server can be accessed by the attackers' malicious code via a script tag"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Understand How to Request JSON Responses from the Target System] An attacker first explores the target system to understand what URLs need to be provided to it in order to retrieve JSON objects that ..."}, {"step": "2", "phase": "Experiment", "description": "[Craft a malicious website]"}, {"step": "3", "phase": "Exploit", "description": "[Launch JSON hijack] An attacker lures the victim to the malicious website or leverages other means to get their malicious code executing in the victim's browser. Once that happens, the malicious code..."}], "related_cwes": ["CWE-345", "CWE-346", "CWE-352"]}, "112": {"name": "Brute Force", "abstraction": "Meta", "status": "Draft", "description": "In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset.", "severity": "High", "prerequisites": ["The attacker must be able to determine when they have successfully guessed the secret. As such, one-time pads are immune to this type of attack since there is no way to determine when a guess is corre..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine secret testing procedure] Determine how a potential guess of the secret may be tested. This may be accomplished by comparing some manipulation of the secret to a known value, use of the sec..."}, {"step": "2", "phase": "Explore", "description": "[Reduce search space] Find ways to reduce the secret space. The smaller the attacker can make the space they need to search for the secret value, the greater their chances for success. There are a gre..."}, {"step": "3", "phase": "Explore", "description": "[Expand victory conditions] It is sometimes possible to expand victory conditions. For example, the attacker might not need to know the exact secret but simply needs a value that produces the same res..."}, {"step": "4", "phase": "Exploit", "description": "[Gather information so attack can be performed independently.] If possible, gather the necessary information so a successful search can be determined without consultation of an external authority. Thi..."}], "related_cwes": ["CWE-330", "CWE-326", "CWE-521"]}, "113": {"name": "Interface Manipulation", "abstraction": "Meta", "status": "Draft", "description": "An adversary manipulates the use or processing of an interface (e.g. Application Programming Interface (API) or System-on-Chip (SoC)) resulting in an adverse impact upon the security of the system implementing the interface. This can allow the adversary to bypass access control and/or execute functionality not intended by the interface implementation, possibly compromising the system which integrates the interface. Interface manipulation can take on a number of forms including forcing the unexpe...", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The target system must expose interface functionality in a manner that can be discovered and manipulated by an adversary. This may require reverse engineering the interface or decrypting/de-obfuscatin..."], "examples": ["An adversary may make a request to an application that leverages a non-standard API that is known to incorrectly validate its data and thus it may be manipulated by supplying metacharacters or alternate encodings as input, resulting in any number of injection flaws, including SQL injection, cross-si...", "API methods not intended for production, such as debugging or testing APIs, may not be disabled when deploying in a production environment. As a result, dangerous functionality can be exposed within the production environment, which an adversary can leverage to execute additional attacks.", "SoC components contain insufficient identifiers, which allows an adversary to reset the device at will or read sensitive data from the device."], "related_cwes": ["CWE-1192"]}, "114": {"name": "Authentication Abuse", "abstraction": "Meta", "status": "Draft", "description": "An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.", "severity": "Medium", "prerequisites": ["An authentication mechanism or subsystem implementing some form of authentication such as passwords, digest authentication, security certificates, etc. which is flawed in some way."], "related_cwes": ["CWE-287", "CWE-1244"]}, "115": {"name": "Authentication Bypass", "abstraction": "Meta", "status": "Draft", "description": "An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.", "severity": "Medium", "prerequisites": ["An authentication mechanism or subsystem implementing some form of authentication such as passwords, digest authentication, security certificates, etc."], "related_cwes": ["CWE-287"]}, "116": {"name": "Excavation", "abstraction": "Meta", "status": "Stable", "description": "An adversary actively probes the target in a manner that is designed to solicit information that could be leveraged for malicious purposes.", "likelihood": "High", "severity": "Medium", "prerequisites": ["An adversary requires some way of interacting with the system."], "related_cwes": ["CWE-200", "CWE-1243"]}, "117": {"name": "Interception", "abstraction": "Meta", "status": "Stable", "description": "An adversary monitors data streams to or from the target for information gathering purposes. This attack may be undertaken to solely gather sensitive information or to support a further attack against the target. This attack pattern can involve sniffing network traffic as well as other types of data streams (e.g. radio). The adversary can attempt to initiate the establishment of a data stream or passively observe the communications as they unfold. In all variants of this attack, the adversary is...", "likelihood": "Low", "severity": "Medium", "prerequisites": ["The target must transmit data over a medium that is accessible to the adversary."], "related_cwes": ["CWE-319"]}, "12": {"name": "Choosing Message Identifier", "abstraction": "Standard", "status": "Draft", "description": "This pattern of attack is defined by the selection of messages distributed via multicast or public information channels that are intended for another client by determining the parameter value assigned to that client. This attack allows the adversary to gain access to potentially privileged information, and to possibly perpetrate other attacks through the distribution means by impersonation. If the channel/message being manipulated is an input rather than output mechanism for the system, (such as...", "likelihood": "High", "severity": "High", "prerequisites": ["Information and client-sensitive (and client-specific) data must be present through a distribution channel available to all users.", "Distribution means must code (through channel, message identifiers, or convention) message destination in a manner visible within the distribution means itself (such as a control channel) or in the me..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine Nature of Messages] Determine the nature of messages being transported as well as the identifiers to be used as part of the attack"}, {"step": "2", "phase": "Experiment", "description": "[Authenticate] If required, authenticate to the distribution channel"}, {"step": "3", "phase": "Experiment", "description": "[Identify Known Client Identifiers] If any particular client's information is available through a control channel available to all users, the adversary will discover particular identifiers for targete..."}, {"step": "4", "phase": "Experiment", "description": "[Change Message Identifier] Adversaries with client access connecting to output channels could change their channel identifier and see someone else's (perhaps more privileged) data."}], "examples": ["A certain B2B interface on a large application codes for messages passed over an MQSeries queue, on a single \"Partners\" channel. Messages on that channel code for their client destination based on a partner_ID field, held by each message. That field is a simple integer. Adversaries having access to ..."], "related_cwes": ["CWE-201", "CWE-306"]}, "120": {"name": "Double Encoding", "abstraction": "Detailed", "status": "Draft", "description": "The adversary utilizes a repeating of the encoding process for a set of characters (that is, character encoding a character encoding of a character) to obfuscate the payload of a particular request. This may allow the adversary to bypass filters that attempt to detect illegal characters or strings, such as those that might be used in traversal or injection attacks. Filters may be able to catch illegal encoded strings, but may not catch doubly encoded strings. For example, a dot (.), often used i...", "likelihood": "Low", "severity": "Medium", "prerequisites": ["The target's filters must fail to detect that a character has been doubly encoded but its interpreting engine must still be able to convert a doubly encoded character to an un-encoded character.", "The application accepts and decodes URL string request.", "The application performs insufficient filtering/canonicalization on the URLs."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an attacker records all entry points to the application."}, {"step": "2", "phase": "Experiment", "description": "[Probe entry points to locate vulnerabilities] Try double-encoding for parts of the input in order to try to get past the filters. For instance, by double encoding certain characters in the URL (e.g. ..."}], "related_cwes": ["CWE-173", "CWE-172", "CWE-177", "CWE-181", "CWE-183", "CWE-184", "CWE-74", "CWE-20", "CWE-697", "CWE-692"]}, "121": {"name": "Exploit Non-Production Interfaces", "abstraction": "Standard", "status": "Stable", "likelihood": "Low", "severity": "High", "prerequisites": ["The target must have configured non-production interfaces and failed to secure or remove them when brought into a production environment."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine Vulnerable Interface] An adversary explores a target system for sample or test interfaces that have not been disabled by a system administrator and which may be exploitable by the adversary..."}, {"step": "2", "phase": "Exploit", "description": "[Leverage Test Interface to Execute Attacks] Once an adversary has discovered a system with a non-production interface, the interface is leveraged to exploit the system and/or conduct various attacks."}], "related_cwes": ["CWE-489", "CWE-1209", "CWE-1259", "CWE-1267", "CWE-1270", "CWE-1294", "CWE-1295", "CWE-1296", "CWE-1302", "CWE-1313"]}, "122": {"name": "Privilege Abuse", "abstraction": "Meta", "status": "Draft", "description": "An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.", "likelihood": "High", "severity": "Medium", "prerequisites": ["The target must have misconfigured their access control mechanisms such that sensitive information, which should only be accessible to more trusted users, remains accessible to less trusted users.", "The adversary must have access to the target, albeit with an account that is less privileged than would be appropriate for the targeted resources."], "related_cwes": ["CWE-269", "CWE-732", "CWE-1317"]}, "123": {"name": "Buffer Manipulation", "abstraction": "Meta", "status": "Draft", "description": "An adversary manipulates an application's interaction with a buffer in an attempt to read or modify data they shouldn't have access to. Buffer attacks are distinguished in that it is the buffer space itself that is the target of the attack rather than any code responsible for interpreting the content of the buffer. In virtually all buffer attacks the content that is placed in the buffer is immaterial. Instead, most buffer attacks involve retrieving or providing more input than can be stored in t...", "likelihood": "High", "severity": "Very High", "prerequisites": ["The adversary must identify a programmatic means for interacting with a buffer, such as vulnerable C code, and be able to provide input to this interaction."], "related_cwes": ["CWE-119"]}, "124": {"name": "Shared Resource Manipulation", "abstraction": "Meta", "status": "Draft", "description": "An adversary exploits a resource shared between multiple applications, an application pool or hardware pin multiplexing to affect behavior. Resources may be shared between multiple applications or between multiple threads of a single application. Resource sharing is usually accomplished through mutual access to a single memory location or multiplexed hardware pins. If an adversary can manipulate this shared resource (usually by co-opting one of the applications or threads) the other applications...", "severity": "Medium", "prerequisites": ["The target applications, threads or functions must share resources between themselves.", "The adversary must be able to manipulate some piece of the shared resource either directly or indirectly and the other users of the data must accept the changed data as valid. Usually this requires th..."], "related_cwes": ["CWE-1189", "CWE-1331"]}, "125": {"name": "Flooding", "abstraction": "Meta", "status": "Stable", "description": "An adversary consumes the resources of a target by rapidly engaging in a large number of interactions with the target. This type of attack generally exposes a weakness in rate limiting or flow. When successful this attack prevents legitimate users from accessing the service and can cause the target to crash. This attack differs from resource depletion through leaks or allocations in that the latter attacks do not rely on the volume of requests made to the target but instead focus on manipulation...", "likelihood": "High", "severity": "Medium", "prerequisites": ["Any target that services requests is vulnerable to this attack on some level of scale."], "related_cwes": ["CWE-404", "CWE-770"]}, "126": {"name": "Path Traversal", "abstraction": "Standard", "status": "Draft", "description": "An adversary uses path manipulation methods to exploit insufficient input validation of a target to obtain access to data that should be not be retrievable by ordinary well-formed requests. A typical variety of this attack involves specifying a path to a desired file together with dot-dot-slash characters, resulting in the file access API or function traversing out of the intended directory structure and into the root file system. By replacing or modifying the expected path information the acces...", "likelihood": "High", "severity": "Very High", "prerequisites": ["The attacker must be able to control the path that is requested of the target.", "The target must fail to adequately sanitize incoming paths"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Fingerprinting of the operating system] In order to perform a valid path traversal, the attacker needs to know what the underlying OS is so that the proper file seperator is used."}, {"step": "2", "phase": "Explore", "description": "[Survey the Application to Identify User-controllable Inputs] The attacker surveys the target application to identify all user-controllable file inputs"}, {"step": "3", "phase": "Experiment", "description": "[Vary inputs, looking for malicious results] Depending on whether the application being exploited is a remote or local one, the attacker crafts the appropriate malicious input containing the path of t..."}, {"step": "4", "phase": "Exploit", "description": "[Manipulate files accessible by the application] The attacker may steal information or directly manipulate files (delete, copy, flush, etc.)"}], "related_cwes": ["CWE-22"]}, "127": {"name": "Directory Indexing", "abstraction": "Detailed", "status": "Draft", "description": "An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the name...", "likelihood": "High", "severity": "Medium", "prerequisites": ["The target must be misconfigured to return a list of a directory's content when it receives a request that ends in a directory name rather than a file name.", "The adversary must be able to control the path that is requested of the target.", "The administrator must have failed to properly configure an ACL or has associated an overly permissive ACL with a particular directory.", "The server version or patch level must not inherently prevent known directory listing attacks from working."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Directory Discovery] Use a method, either manual, scripted, or automated to discover the directories on the server by making requests for directories that may possibly exist. During this phase the ad..."}, {"step": "2", "phase": "Experiment", "description": "[Iteratively explore directory/file structures] The adversary attempts to access the discovered directories that allow access and may attempt to bypass server or application level ACLs by using manual..."}, {"step": "3", "phase": "Exploit", "description": "[Read directories or files which are not intended for public viewing.] The adversary attempts to access the discovered directories that allow access and may attempt to bypass server or application lev..."}], "related_cwes": ["CWE-424", "CWE-425", "CWE-288", "CWE-285", "CWE-732", "CWE-276", "CWE-693"]}, "128": {"name": "Integer Attacks", "abstraction": "Standard", "status": "Draft", "description": "An attacker takes advantage of the structure of integer variables to cause these variables to assume values that are not expected by an application. For example, adding one to the largest positive integer in a signed integer variable results in a negative number. Negative numbers may be illegal in an application and the application may prevent an attacker from providing them directly, but the application may not consider that adding two positive numbers can create a negative number do to the str...", "severity": "Medium", "prerequisites": ["The target application must have an integer variable for which only some of the possible integer values are expected by the application and where there are no checks on the value of the variable befor...", "The attacker must be able to manipulate the targeted integer variable such that normal operations result in non-standard values due to the storage structure of integers."], "related_cwes": ["CWE-682"]}, "129": {"name": "Pointer Manipulation", "abstraction": "Meta", "status": "Draft", "description": "This attack pattern involves an adversary manipulating a pointer within a target application resulting in the application accessing an unintended memory location. This can result in the crashing of the application or, for certain pointer values, access to data that would not normally be possible or the execution of arbitrary code. Since pointers are simply integer variables, Integer Attacks may often be used in Pointer Attacks.", "severity": "Medium", "prerequisites": ["The target application must have a pointer variable that the attacker can influence to hold an arbitrary value."], "related_cwes": ["CWE-682", "CWE-822", "CWE-823"]}, "13": {"name": "Subverting Environment Variable Values", "abstraction": "Detailed", "status": "Stable", "description": "The adversary directly or indirectly modifies environment variables used by or controlling the target software. The adversary's goal is to cause the target software to deviate from its expected operation in a manner that benefits the adversary.", "likelihood": "High", "severity": "Very High", "prerequisites": ["An environment variable is accessible to the user.", "An environment variable used by the application can be tainted with user supplied data.", "Input data used in an environment variable is not validated properly.", "The variables encapsulation is not done properly. For instance setting a variable as public in a class makes it visible and an adversary may attempt to manipulate that variable."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Probe target application] The adversary first probes the target application to determine important information about the target. This information could include types software used, software versions,..."}, {"step": "2", "phase": "Experiment", "description": "[Find user-controlled environment variables] Using the information found by probing the application, the adversary attempts to manipulate any user-controlled environment variables they have found are ..."}, {"step": "3", "phase": "Exploit", "description": "[Manipulate user-controlled environment variables] The adversary manipulates the found environment variable(s) to abuse the normal flow of processes or to gain access to privileged resources."}], "examples": ["Changing the LD_LIBRARY_PATH environment variable in TELNET will cause TELNET to use an alternate (possibly Trojan) version of a function library. The Trojan library must be accessible using the target file system and should include Trojan code that will allow the user to log in with a bad password....", "The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. This setting can be configured to ignore commands that start with a space by simply setting it to \"ignorespace\". HISTCONTROL can also be ..."], "related_cwes": ["CWE-353", "CWE-285", "CWE-302", "CWE-74", "CWE-15", "CWE-73", "CWE-20", "CWE-200"]}, "130": {"name": "Excessive Allocation", "abstraction": "Meta", "status": "Stable", "description": "An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources. This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion throu...", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The target must accept service requests from the attacker and the adversary must be able to control the resource allocation associated with this request to be in excess of the normal allocation. The l..."], "examples": ["In an Integer Attack, the adversary could cause a variable that controls allocation for a request to hold an excessively large value. Excessive allocation of resources can render a service degraded or unavailable to legitimate users and can even lead to crashing of the target."], "related_cwes": ["CWE-404", "CWE-770", "CWE-1325"]}, "131": {"name": "Resource Leak Exposure", "abstraction": "Meta", "status": "Stable", "description": "An adversary utilizes a resource leak on the target to deplete the quantity of the resource available to service legitimate requests.", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The target must have a resource leak that the adversary can repeatedly trigger."], "related_cwes": ["CWE-404"]}, "132": {"name": "Symlink Attack", "abstraction": "Detailed", "status": "Draft", "description": "An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.", "likelihood": "Low", "severity": "High", "prerequisites": ["The targeted application must perform the desired activities on a file without checking whether the file is a symbolic link or not. The adversary must be able to predict the name of the file the targe..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify Target] Adversary identifies the target application by determining whether there is sufficient check before writing data to a file and creating symlinks to files in different directories."}, {"step": "2", "phase": "Experiment", "description": "[Try to create symlinks to different files] The adversary then uses a variety of techniques, such as monitoring or guessing to create symlinks to the files accessed by the target application in the di..."}, {"step": "3", "phase": "Exploit", "description": "[Target application operates on created symlinks to sensitive files] The adversary is able to create symlinks to sensitive files while the target application is operating on the file."}], "related_cwes": ["CWE-59"]}, "133": {"name": "Try All Common Switches", "abstraction": "Standard", "status": "Draft", "description": "An attacker attempts to invoke all common switches and options in the target application for the purpose of discovering weaknesses in the target. For example, in some applications, adding a --debug switch causes debugging information to be displayed, which can sometimes reveal sensitive processing or configuration information to an attacker. This attack differs from other forms of API abuse in that the attacker is indiscriminately attempting to invoke options in the hope that one of them will wo...", "severity": "Medium", "prerequisites": ["The attacker must be able to control the options or switches sent to the target."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify application] Discover an application of interest by exploring service registry listings or by connecting on a known port or some similar means."}, {"step": "2", "phase": "Explore", "description": "[Authenticate to application] Authenticate to the application, if required, in order to explore it."}, {"step": "3", "phase": "Experiment", "description": "[Try all common switches] Using manual or automated means, attempt to run the application with many different known common switches. Observe the output to see if any switches seemed to put the applica..."}, {"step": "4", "phase": "Exploit", "description": "[Use sensitive processing or configuration information] Once extra information is observed from an application through the use of a common switch, this information is used to aid other attacks on the ..."}], "related_cwes": ["CWE-912"]}, "134": {"name": "Email Injection", "abstraction": "Standard", "status": "Draft", "description": "An adversary manipulates the headers and content of an email message by injecting data via the use of delimiter characters native to the protocol.", "severity": "Medium", "prerequisites": ["The target application must allow the user to send email to some recipient, to specify the content at least one header field in the message, and must fail to sanitize against the injection of command ...", "The adversary must have the ability to access the target mail application."], "related_cwes": ["CWE-150"]}, "135": {"name": "Format String Injection", "abstraction": "Standard", "status": "Draft", "description": "An adversary includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the ...", "likelihood": "High", "severity": "High", "prerequisites": ["The target application must accept a strings as user input, fail to sanitize string formatting characters in the user input, and process this string using functions that interpret string formatting ch..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey application] The adversary takes an inventory of the entry points of the application."}, {"step": "2", "phase": "Experiment", "description": "[Determine user-controllable input susceptible to format string injection] Determine the user-controllable input susceptible to format string injection. For each user-controllable input that the adver..."}, {"step": "3", "phase": "Exploit", "description": "[Try to exploit the Format String Injection vulnerability] After determining that a given input is vulnerable to format string injection, hypothesize what the underlying usage looks like and the assoc..."}], "examples": ["Untrusted search path vulnerability in the add_filename_to_string function in intl/gettext/loadmsgcat.c for Elinks 0.11.1 allows local users to cause Elinks to use an untrusted gettext message catalog (.po file) in a \"../po\" directory, which can be leveraged to conduct format string attacks. See als..."], "related_cwes": ["CWE-134", "CWE-20", "CWE-74"]}, "136": {"name": "LDAP Injection", "abstraction": "Standard", "status": "Draft", "description": "An attacker manipulates or crafts an LDAP query for the purpose of undermining the security of the target. Some applications use user input to create LDAP queries that are processed by an LDAP server. For example, a user might provide their username during authentication and the username might be inserted in an LDAP query during the authentication process. An attacker could use this input to inject additional commands into an LDAP query that could disclose sensitive information. For example, ent...", "likelihood": "High", "severity": "High", "prerequisites": ["The target application must accept a string as user input, fail to sanitize characters that have a special meaning in LDAP queries in the user input, and insert the user-supplied string in an LDAP que..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey application] The attacker takes an inventory of the entry points of the application."}, {"step": "2", "phase": "Experiment", "description": "[Determine user-controllable input susceptible to LDAP injection] For each user-controllable input that the attacker suspects is vulnerable to LDAP injection, attempt to inject characters that have sp..."}, {"step": "3", "phase": "Experiment", "description": "[Try to exploit the LDAP injection vulnerability] After determining that a given input is vulnerable to LDAP Injection, hypothesize what the underlying query looks like. Possibly using a tool, iterati..."}], "examples": ["PowerDNS before 2.9.18, when running with an LDAP backend, does not properly escape LDAP queries, which allows remote attackers to cause a denial of service (failure to answer ldap questions) and possibly conduct an LDAP injection attack. See also: CVE-2005-2301"], "related_cwes": ["CWE-77", "CWE-90", "CWE-20"]}, "137": {"name": "Parameter Injection", "abstraction": "Meta", "status": "Stable", "description": "An adversary manipulates the content of request parameters for the purpose of undermining the security of the target. Some parameter encodings use text characters as separators. For example, parameters in a HTTP GET message are encoded as name-value pairs separated by an ampersand (&). If an attacker can supply text strings that are used to fill in these parameters, then they can inject special characters used in the encoding scheme to add or modify parameters. For example, if user input is fed ...", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The target application must use a parameter encoding where separators and parameter identifiers are expressed in regular text.", "The target application must accept a string as user input, fail to sanitize characters that have a special meaning in the parameter encoding, and insert the user-supplied string in an encoding which i..."], "related_cwes": ["CWE-88"]}, "138": {"name": "Reflection Injection", "abstraction": "Standard", "status": "Draft", "description": "An adversary supplies a value to the target application which is then used by reflection methods to identify a class, method, or field. For example, in the Java programming language the reflection libraries permit an application to inspect, load, and invoke classes and their components by name. If an adversary can control the input into these methods including the name of the class/method/field or the parameters passed to methods, they can cause the targeted application to invoke incorrect metho...", "severity": "Very High", "prerequisites": ["The target application must utilize reflection libraries and allow users to directly control the parameters to these methods. If the adversary can host classes where the target can invoke them, more p...", "The target application must accept a string as user input, fail to sanitize characters that have a special meaning in the parameter encoding, and insert the user-supplied string in an encoding which i..."], "related_cwes": ["CWE-470"]}, "139": {"name": "Relative Path Traversal", "abstraction": "Detailed", "status": "Draft", "description": "An attacker exploits a weakness in input validation on the target by supplying a specially constructed path utilizing dot and slash characters for the purpose of obtaining access to arbitrary files or resources. An attacker modifies a known path on the target in order to reach material that is not available through intended channels. These attacks normally involve adding additional path separators (/ or \\) and/or dots (.), or encodings thereof, in various combinations in order to reach parent di...", "likelihood": "High", "severity": "High", "prerequisites": ["The target application must accept a string as user input, fail to sanitize combinations of characters in the input that have a special meaning in the context of path navigation, and insert the user-s..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Fingerprinting of the operating system] In order to perform a valid path traversal, the adversary needs to know what the underlying OS is so that the proper file seperator is used."}, {"step": "2", "phase": "Explore", "description": "[Survey application] Using manual or automated means, an adversary will survey the target application looking for all areas where user input is taken to specify a file name or path."}, {"step": "3", "phase": "Experiment", "description": "[Attempt variations on input parameters] Using manual or automated means, an adversary attempts varying relative file path combinations on all found user input locations and observes the responses."}, {"step": "4", "phase": "Exploit", "description": "[Access, modify, or execute arbitrary files.] An adversary injects path traversal syntax into identified vulnerable inputs to cause inappropriate reading, writing or execution of files. An adversary c..."}], "related_cwes": ["CWE-23"]}, "14": {"name": "Client-side Injection-induced Buffer Overflow", "abstraction": "Detailed", "status": "Draft", "description": "This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service. This hostile service is created to deliver the correct content to the client software. For example, if the client-side application is a browser, the service will host a webpage that the browser loads.", "likelihood": "Medium", "severity": "High", "prerequisites": ["The targeted client software communicates with an external server.", "The targeted client software has a buffer overflow vulnerability."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target client-side application] The adversary identifies a target client-side application to perform the buffer overflow on. The most common are browsers. If there is a known browser vulnera..."}, {"step": "2", "phase": "Experiment", "description": "[Find injection vector] The adversary identifies an injection vector to deliver the excessive content to the targeted application's buffer."}, {"step": "3", "phase": "Experiment", "description": "[Create hostile service] The adversary creates a hostile service that will deliver content to the client-side application. If the intent is to simply cause the software to crash, the content need only..."}, {"step": "4", "phase": "Exploit", "description": "[Overflow the buffer] Using the injection vector, the adversary delivers the content to the client-side application using the hostile service and overflows the buffer."}], "related_cwes": ["CWE-120", "CWE-353", "CWE-118", "CWE-119", "CWE-74", "CWE-20", "CWE-680", "CWE-697"]}, "140": {"name": "Bypassing of Intermediate Forms in Multiple-Form Sets", "abstraction": "Standard", "status": "Draft", "description": "Some web applications require users to submit information through an ordered sequence of web forms. This is often done if there is a very large amount of information being collected or if information on earlier forms is used to pre-populate fields or determine which additional information the application needs to collect. An attacker who knows the names of the various forms in the sequence may be able to explicitly type in the name of a later form and navigate to it without first going through t...", "severity": "Medium", "prerequisites": ["The target must collect information from the user in a series of forms where each form has its own URL that the attacker can anticipate and the application must fail to detect attempts to access inter..."], "related_cwes": ["CWE-372"]}, "141": {"name": "Cache Poisoning", "abstraction": "Standard", "status": "Draft", "description": "An attacker exploits the functionality of cache technologies to cause specific data to be cached that aids the attackers' objectives. This describes any attack whereby an attacker places incorrect or harmful material in cache. The targeted cache can be an application's cache (e.g. a web browser cache) or a public cache (e.g. a DNS or ARP cache). Until the cache is refreshed, most applications or clients will treat the corrupted cache value as valid. This can lead to a wide range of exploits incl...", "likelihood": "High", "severity": "High", "prerequisites": ["The attacker must be able to modify the value stored in a cache to match a desired value.", "The targeted application must not be able to detect the illicit modification of the cache and must trust the cache value in its calculations."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify and explore caches] Use tools to sniff traffic and scan a network in order to locate application's cache (e.g. a web browser cache) or a public cache (e.g. a DNS or ARP cache) that may have ..."}, {"step": "2", "phase": "Experiment", "description": "[Cause specific data to be cached] An attacker sends bogus request to the target, and then floods responses that trick a cache to remember malicious responses, which are wrong answers of queries."}, {"step": "3", "phase": "Exploit", "description": "[Redirect users to malicious website] As the attacker succeeds in exploiting the vulnerability, they are able to manipulate and interpose malicious response data to targeted victim queries."}], "related_cwes": ["CWE-348", "CWE-345", "CWE-349", "CWE-346"]}, "142": {"name": "DNS Cache Poisoning", "abstraction": "Detailed", "status": "Draft", "description": "A domain name server translates a domain name (such as www.example.com) into an IP address that Internet hosts use to contact Internet resources. An adversary modifies a public DNS cache to cause certain names to resolve to incorrect addresses that the adversary specifies. The result is that client applications that rely upon the targeted cache for domain name resolution will be directed not to the actual address of the specified domain name but to some other address. Adversaries can use this to...", "likelihood": "High", "severity": "High", "prerequisites": ["A DNS cache must be vulnerable to some attack that allows the adversary to replace addresses in its lookup table.Client applications must trust the corrupted cashed values and utilize them for their d..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Explore resolver caches] Check DNS caches on local DNS server and client's browser with DNS cache enabled."}, {"step": "2", "phase": "Experiment", "description": "[Attempt sending crafted records to DNS cache] A request is sent to the authoritative server for target website and wait for the iterative name resolver. An adversary sends bogus request to the DNS lo..."}, {"step": "3", "phase": "Exploit", "description": "[Redirect users to malicious website] As the adversary succeeds in exploiting the vulnerability, the victim connects to a malicious site using a good web site's domain name."}], "related_cwes": ["CWE-348", "CWE-345", "CWE-349", "CWE-346", "CWE-350"]}, "143": {"name": "Detect Unpublicized Web Pages", "abstraction": "Detailed", "status": "Draft", "description": "An adversary searches a targeted web site for web pages that have not been publicized. In doing this, the adversary may be able to gain access to information that the targeted site did not intend to make public.", "severity": "Low", "prerequisites": ["The targeted web site must include pages within its published tree that are not connected to its tree of links. The sensitivity of the content of these pages determines the severity of this attack."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find target web site] An adversary finds a target web site that they think may have unpublicized web pages"}, {"step": "2", "phase": "Explore", "description": "[Map the published web site] The adversary will map the published web site either by using an automated tool or by manually accessing well-known debugging or logging pages, or otherwise predictable pa..."}, {"step": "3", "phase": "Experiment", "description": "[Try to find weaknesses or information] The adversary will try to find weaknesses or information on the unpublicized pages that the targeted site did not intend to be public"}, {"step": "4", "phase": "Exploit", "description": "[Follow-up attack] Use any information or weaknesses found to carry out a follow-up attack"}], "related_cwes": ["CWE-425"]}, "144": {"name": "Detect Unpublicized Web Services", "abstraction": "Detailed", "status": "Draft", "description": "An adversary searches a targeted web site for web services that have not been publicized. This attack can be especially dangerous since unpublished but available services may not have adequate security controls placed upon them given that an administrator may believe they are unreachable.", "severity": "Low", "prerequisites": ["The targeted web site must include unpublished services within its web tree. The nature of these services determines the severity of this attack."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find target web site] An adversary finds a target web site that they think may have unpublicized web services"}, {"step": "2", "phase": "Explore", "description": "[Map the published web site] The adversary will map the published web site either by using an automated tool or by manually accessing well-known debugging or logging pages, or otherwise predictable pa..."}, {"step": "3", "phase": "Experiment", "description": "[Try to find weaknesses or information] The adversary will try to find weaknesses in the unpublicized services that the targeted site did not intend to be public"}, {"step": "4", "phase": "Exploit", "description": "[Follow-up attack] Use any information or weaknesses found to carry out a follow-up attack"}], "related_cwes": ["CWE-425"]}, "145": {"name": "Checksum Spoofing", "abstraction": "Detailed", "status": "Draft", "description": "An adversary spoofs a checksum message for the purpose of making a payload appear to have a valid corresponding checksum. Checksums are used to verify message integrity. They consist of some value based on the value of the message they are protecting. Hash codes are a common checksum mechanism. Both the sender and recipient are able to compute the checksum based on the contents of the message. If the message contents change between the sender and recipient, the sender and recipient will compute ...", "severity": "Medium", "prerequisites": ["The adversary must be able to intercept a message from the sender (keeping the recipient from getting it), modify it, and send the modified message to the recipient.", "The sender and recipient must use a checksum to protect the integrity of their message and transmit this checksum in a manner where the adversary can intercept and modify it.", "The checksum value must be computable using information known to the adversary. A cryptographic checksum, which uses a key known only to the sender and recipient, would thwart this attack."], "related_cwes": ["CWE-354"]}, "146": {"name": "XML Schema Poisoning", "abstraction": "Detailed", "status": "Stable", "description": "An adversary corrupts or modifies the content of XML schema information passed between a client and server for the purpose of undermining the security of the target. XML Schemas provide the structure and content definitions for XML documents. Schema poisoning is the ability to manipulate a schema either by replacing or modifying it to compromise the programs that process documents that use this schema.", "likelihood": "Low", "severity": "High", "prerequisites": ["Some level of access to modify the target schema.", "The schema used by the target application must be improperly secured against unauthorized modification and manipulation."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine if XML schema is local or remote] Because this attack differs slightly if the target uses remote XML schemas versus local schemas, the adversary first needs to determine which of the two ar..."}, {"step": "2", "phase": "Experiment", "description": "[Gain access to XML schema] The adversary gains access to the XML schema so that they can modify the contents."}, {"step": "3", "phase": "Exploit", "description": "[Poison XML schema] Once the adversary gains access to the XML schema, they will alter it to achieve a desired effect. Locally, they can simply modify the file. For remote schemas, the adversary will ..."}], "related_cwes": ["CWE-15", "CWE-472"]}, "147": {"name": "XML Ping of the Death", "abstraction": "Detailed", "status": "Draft", "description": "An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the...", "likelihood": "Low", "severity": "Medium", "prerequisites": ["The target must receive and process XML transactions."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the target] Using a browser or an automated tool, an attacker records all instance of web services to process XML requests."}, {"step": "2", "phase": "Exploit", "description": "[Launch a resource depletion attack] The attacker delivers a large number of small XML messages to the target URLs found in the explore phase at a sufficiently rapid rate. It causes denial of service ..."}], "examples": ["Consider the case of attack performed against the createCustomerBillingAccount Web Service for an online store. In this case, the createCustomerBillingAccount Web Service receives a huge number of simultaneous requests, containing nonsense billing account creation information (the small XML messages..."], "related_cwes": ["CWE-400", "CWE-770"]}, "148": {"name": "Content Spoofing", "abstraction": "Meta", "status": "Stable", "description": "An adversary modifies content to make it contain something other than what the original content producer intended while keeping the apparent source of the content unchanged. The term content spoofing is most often used to describe modification of web pages hosted by a target to display the adversary's content instead of the owner's content. However, any content can be spoofed, including the content of email messages, file transfers, or the content of other network communication protocols. Conten...", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The target must provide content but fail to adequately protect it against modification.The adversary must have the means to alter data to which they are not authorized. If the content is to be modifie..."], "related_cwes": ["CWE-345"]}, "149": {"name": "Explore for Predictable Temporary File Names", "abstraction": "Detailed", "status": "Draft", "description": "An attacker explores a target to identify the names and locations of predictable temporary files for the purpose of launching further attacks against the target. This involves analyzing naming conventions and storage locations of the temporary files created by a target application. If an attacker can predict the names of temporary files they can use this information to mount other attacks, such as information gathering and symlink attacks.", "severity": "Medium", "prerequisites": ["The targeted application must create names for temporary files using a predictable procedure, e.g. using sequentially increasing numbers.", "The attacker must be able to see the names of the files the target is creating."], "related_cwes": ["CWE-377"]}, "15": {"name": "Command Delimiters", "abstraction": "Standard", "status": "Draft", "description": "An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the comm...", "likelihood": "High", "severity": "High", "prerequisites": ["Software's input validation or filtering must not detect and block presence of additional malicious command."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Assess Target Runtime Environment] In situations where the runtime environment is not implicitly known, the attacker makes connections to the target system and tries to determine the system's runtime..."}, {"step": "2", "phase": "Explore", "description": "[Survey the Application] The attacker surveys the target application, possibly as a valid and authenticated user"}, {"step": "3", "phase": "Experiment", "description": "[Attempt delimiters in inputs] The attacker systematically attempts variations of delimiters on known inputs, observing the application's response each time."}, {"step": "4", "phase": "Exploit", "description": "[Use malicious command delimiters] The attacker uses combinations of payload and carefully placed command delimiters to attack the software."}], "related_cwes": ["CWE-146", "CWE-77", "CWE-184", "CWE-78", "CWE-185", "CWE-93", "CWE-140", "CWE-157", "CWE-138", "CWE-154", "CWE-697"]}, "150": {"name": "Collect Data from Common Resource Locations", "abstraction": "Standard", "status": "Draft", "description": "An adversary exploits well-known locations for resources for the purposes of undermining the security of the target. In many, if not most systems, files and resources are organized in a default tree structure. This can be useful for adversaries because they often know where to look for resources or files that are necessary for attacks. Even when the precise location of a targeted resource may not be known, naming conventions may indicate a small area of the target machine's file tree where the r...", "severity": "Medium", "prerequisites": ["The targeted applications must either expect files to be located at a specific location or, if the location of the files can be configured by the user, the user either failed to move the files from th..."], "examples": ["An adversary can use a technique called Bluesnarfing to retrieve data from Bluetooth enabled devices in which they know where the data is located. This is done by connecting to the device\u2019s Object Exchange (OBEX) Push Profile and making OBEX GET requests for known filenames (contact lists, photos, r..."], "related_cwes": ["CWE-552", "CWE-1239", "CWE-1258", "CWE-1266", "CWE-1272", "CWE-1323", "CWE-1330"]}, "151": {"name": "Identity Spoofing", "abstraction": "Meta", "status": "Stable", "description": "Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The identity associated with the message or resource must be removable or modifiable in an undetectable way."], "related_cwes": ["CWE-287"]}, "153": {"name": "Input Data Manipulation", "abstraction": "Meta", "status": "Draft", "description": "An attacker exploits a weakness in input validation by controlling the format, structure, and composition of data to an input-processing interface. By supplying input of a non-standard or unexpected form an attacker can adversely impact the security of the target.", "severity": "Medium", "prerequisites": ["The target must accept user data for processing and the manner in which this data is processed must depend on some aspect of the format or flags that the attacker can control."], "related_cwes": ["CWE-20"]}, "154": {"name": "Resource Location Spoofing", "abstraction": "Meta", "status": "Stable", "description": "An adversary deceives an application or user and convinces them to request a resource from an unintended location. By spoofing the location, the adversary can cause an alternate resource to be used, often one that the adversary controls and can be used to help them achieve their malicious goals.", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["None. All applications rely on file paths and therefore, in theory, they or their resources could be affected by this type of attack."], "related_cwes": ["CWE-451"]}, "155": {"name": "Screen Temporary Files for Sensitive Information", "abstraction": "Detailed", "status": "Draft", "description": "An adversary exploits the temporary, insecure storage of information by monitoring the content of files used to store temp data during an application's routine execution flow. Many applications use temporary files to accelerate processing or to provide records of state across multiple executions of the application. Sometimes, however, these temporary files may end up storing sensitive information. By screening an application's temporary files, an adversary might be able to discover such sensitiv...", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The target application must utilize temporary files and must fail to adequately secure them against other parties reading them."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Look for temporary files in target application] An adversary will try to discover temporary files in a target application. Knowledge of where the temporary files are being stored is important informa..."}, {"step": "2", "phase": "Experiment", "description": "[Attempt to read temporary files] An adversary will attempt to read any temporary files they may have discovered through normal means."}, {"step": "3", "phase": "Exploit", "description": "[Use function weaknesses to gain access to temporary files] If normal means to read temporary files did not work, an adversary will attempt to exploit weak temporary file functions to gain access to t..."}], "related_cwes": ["CWE-377"]}, "157": {"name": "Sniffing Attacks", "abstraction": "Standard", "status": "Draft", "description": "In this attack pattern, the adversary intercepts information transmitted between two third parties. The adversary must be able to observe, read, and/or hear the communication traffic, but not necessarily block the communication or change its content. Any transmission medium can theoretically be sniffed if the adversary can examine the contents between the sender and recipient. Sniffing Attacks are similar to Adversary-In-The-Middle attacks (CAPEC-94), but are entirely passive. AiTM attacks are p...", "severity": "Medium", "prerequisites": ["The target data stream must be transmitted on a medium to which the adversary has access."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine Communication Mechanism] The adversary determines the nature and mechanism of communication between two components, looking for opportunities to exploit."}, {"step": "2", "phase": "Experiment", "description": "[Position In Between Targets] The adversary positions themselves somewhere in the middle of the two components. If the communication is encrypted, the adversary will need to act as a proxy and route t..."}, {"step": "3", "phase": "Exploit", "description": "[Listen to Communication] The adversary observes communication, but does not alter or block it. The adversary gains access to sensitive information and can potentially utilize this information in a ma..."}], "related_cwes": ["CWE-311"]}, "158": {"name": "Sniffing Network Traffic", "abstraction": "Detailed", "status": "Draft", "description": "In this attack pattern, the adversary monitors network traffic between nodes of a public or multicast network in an attempt to capture sensitive information at the protocol level. Network sniffing applications can reveal TCP/IP, DNS, Ethernet, and other low-level network communication information. The adversary takes a passive role in this attack pattern and simply observes and analyzes the traffic. The adversary may precipitate or indirectly influence the content of the observed transaction, bu...", "severity": "Medium", "prerequisites": ["The target must be communicating on a network protocol visible by a network sniffing application.", "The adversary must obtain a logical position on the network from intercepting target network traffic is possible. Depending on the network topology, traffic sniffing may be simple or challenging. If b..."], "related_cwes": ["CWE-311"]}, "159": {"name": "Redirect Access to Libraries", "abstraction": "Standard", "status": "Stable", "description": "An adversary exploits a weakness in the way an application searches for external libraries to manipulate the execution flow to point to an adversary supplied library or code base. This pattern of attack allows the adversary to compromise the application or server via the execution of unauthorized code. An application typically makes calls to functions that are a part of libraries external to the application. These libraries may be part of the operating system or they may be third party libraries...", "likelihood": "High", "severity": "Very High", "prerequisites": ["The target must utilize external libraries and must fail to verify the integrity of these libraries before using them."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify Target] The adversary identifies the target application and determines what libraries are being used."}, {"step": "2", "phase": "Experiment", "description": "[Deploy Malicious Libraries] The adversary crafts malicious libraries and deploys them on the system where the application is running, or in a remote location that can be loaded by the application."}, {"step": "3", "phase": "Exploit", "description": "[Redirect Library Calls to Malicious Library] Once the malicious library crafted by the adversary is deployed, the adversary will manipulate the flow of the application such that it calls the maliciou..."}], "examples": ["In this example, the attacker using ELF infection that redirects the Procedure Linkage Table (PLT) of an executable allowing redirection to be resident outside of the infected executable. The algorithm at the entry point code is as follows... \u2022 mark the text segment writeable \u2022 save the PLT(GOT) ent..."], "related_cwes": ["CWE-706"]}, "16": {"name": "Dictionary-based Password Attack", "abstraction": "Detailed", "status": "Draft", "likelihood": "Medium", "severity": "High", "prerequisites": ["The system uses one factor password based authentication.", "The system does not have a sound password policy that is being enforced.", "The system does not implement an effective password throttling mechanism."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine application's/system's password policy] Determine the password policies of the target application/system."}, {"step": "2", "phase": "Explore", "description": "[Select dictionaries] Pick the dictionaries to be used in the attack (e.g. different languages, specific terminology, etc.)"}, {"step": "3", "phase": "Explore", "description": "[Determine username(s) to target] Determine username(s) whose passwords to crack."}, {"step": "4", "phase": "Exploit", "description": "[Use dictionary to crack passwords.] Use a password cracking tool that will leverage the dictionary to feed passwords to the system and see if they work."}], "examples": ["A system user selects the word \"treacherous\" as their passwords believing that it would be very difficult to guess. The password-based dictionary attack is used to crack this password and gain access to the account."], "related_cwes": ["CWE-521", "CWE-262", "CWE-263", "CWE-654", "CWE-307", "CWE-308", "CWE-309"]}, "160": {"name": "Exploit Script-Based APIs", "abstraction": "Standard", "status": "Draft", "description": "Some APIs support scripting instructions as arguments. Methods that take scripted instructions (or references to scripted instructions) can be very flexible and powerful. However, if an attacker can specify the script that serves as input to these methods they can gain access to a great deal of functionality. For example, HTML pages support <script> tags that allow scripting languages to be embedded in the page and then interpreted by the receiving web browser. If the content provider is malicio...", "severity": "Medium", "prerequisites": ["The target application must include the use of APIs that execute scripts.", "The target application must allow the attacker to provide some or all of the arguments to one of these script interpretation methods and must fail to adequately filter these arguments for dangerous or..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify API] Discover an API of interest by exploring application documentation or observing responses to API calls"}, {"step": "2", "phase": "Experiment", "description": "[Test simple script] Adversaries will attempt to give a smaller script as input to the API, such as simply printing to the console, to see if the attack is viable."}, {"step": "3", "phase": "Exploit", "description": "[Give malicious scripting instructions to API] Adversaries will now craft custom scripts to do malicious behavior. Depending on the setup of the application this script could be run with user or admin..."}], "related_cwes": ["CWE-346"]}, "161": {"name": "Infrastructure Manipulation", "abstraction": "Meta", "status": "Draft", "description": "An attacker exploits characteristics of the infrastructure of a network entity in order to perpetrate attacks or information gathering on network objects or effect a change in the ordinary information flow between network objects. Most often, this involves manipulation of the routing of network messages so, instead of arriving at their proper destination, they are directed towards an entity of the attackers' choosing, usually a server controlled by the attacker. The victim is often unaware that ...", "severity": "High", "prerequisites": ["The targeted client must access the site via infrastructure that the attacker has co-opted and must fail to adequately verify that the communication channel is operating correctly (e.g. by verifying t..."], "related_cwes": ["CWE-923"]}, "162": {"name": "Manipulating Hidden Fields", "abstraction": "Detailed", "status": "Draft", "description": "An adversary exploits a weakness in the server's trust of client-side processing by modifying data on the client-side, such as price information, and then submitting this data to the server, which processes the modified data. For example, eShoplifting is a data manipulation attack against an on-line merchant during a purchasing transaction. The manipulation of price, discount or quantity fields in the transaction message allows the adversary to acquire items at a lower cost than the merchant int...", "severity": "High", "prerequisites": ["The targeted site must contain hidden fields to be modified.", "The targeted site must not validate the hidden fields with backend processing."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Probe target web application] The adversary first probes the target web application to find all possible pages that can be visited on the website."}, {"step": "2", "phase": "Explore", "description": "[Find hidden fields] Once the web application has been traversed, the adversary looks for all hidden HTML fields present in the client-side."}, {"step": "3", "phase": "Experiment", "description": "[Send modified hidden fields to server-side] Once the adversary has found hidden fields in the client-side, they will modify the values of these hidden fields one by one and then interact with the web..."}, {"step": "4", "phase": "Exploit", "description": "[Manipulate hidden fields] Once the adversary has determined which hidden fields are not being validated by the server, they will manipulate them to change the normal behavior of the web application i..."}], "related_cwes": ["CWE-602"]}, "163": {"name": "Spear Phishing", "abstraction": "Detailed", "status": "Draft", "description": "An adversary targets a specific user or group with a Phishing (CAPEC-98) attack tailored to a category of users in order to have maximum relevance and deceptive capability. Spear Phishing is an enhanced version of the Phishing attack targeted to a specific user or group. The quality of the targeted email is usually enhanced by appearing to come from a known or trusted entity. If the email account of some trusted entity has been compromised the message may be digitally signed. The message will co...", "likelihood": "High", "severity": "High", "prerequisites": ["None. Any user can be targeted by a Spear Phishing attack."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Obtain useful contextual detailed information about the targeted user or organization] An adversary collects useful contextual detailed information about the targeted user or organization in order to..."}, {"step": "2", "phase": "Experiment", "description": "[Optional: Obtain domain name and certificate to spoof legitimate site] This optional step can be used to help the adversary impersonate the legitimate site more convincingly. The adversary can use ho..."}, {"step": "3", "phase": "Experiment", "description": "[Optional: Explore legitimate website and create duplicate] An adversary creates a website (optionally at a URL that looks similar to the original URL) that closely resembles the website that they are..."}, {"step": "4", "phase": "Experiment", "description": "[Optional: Build variants of the website with very specific user information e.g., living area, etc.] Once the adversary has their website which duplicates a legitimate website, they need to build ver..."}, {"step": "5", "phase": "Exploit", "description": "[Convince user to enter sensitive information on adversary's site.] An adversary sends a message (typically an e-mail) to the victim that has some sort of a call to action to get the user to click on ..."}, {"step": "6", "phase": "Exploit", "description": "[Use stolen credentials to log into legitimate site] Once the adversary captures some sensitive information through phishing (login credentials, credit card information, etc.) the adversary can levera..."}], "examples": ["The target gets an official looking e-mail from their bank stating that their account has been temporarily locked due to suspected unauthorized activity that happened in a different area from where they live (details might be provided by the spear phishers) and that they need to click on the link in...", "An adversary can leverage a weakness in the SMB protocol by sending the target, an official looking e-mail from their employer's IT Department stating that their system has vulnerable software, which they need to manually patch by accessing an updated version of the software by clicking on a provide..."], "related_cwes": ["CWE-451"]}, "164": {"name": "Mobile Phishing", "abstraction": "Detailed", "status": "Stable", "description": "An adversary targets mobile phone users with a phishing attack for the purpose of soliciting account passwords or sensitive information from the user. Mobile Phishing is a variation of the Phishing social engineering technique where the attack is initiated via a text or SMS message, rather than email. The user is enticed to provide information or visit a compromised web site via this message. Apart from the manner in which the attack is initiated, the attack proceeds as a standard Phishing attac...", "likelihood": "High", "severity": "High", "prerequisites": ["An adversary needs mobile phone numbers to initiate contact with the victim.", "An adversary needs to correctly guess the entity with which the victim does business and impersonate it. Most of the time phishers just use the most popular banks/services and send out their \"hooks\" t...", "An adversary needs to have a sufficiently compelling call to action to prompt the user to take action.", "The replicated website needs to look extremely similar to the original website and the URL used to get to that website needs to look like the real URL of the said business entity."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Obtain domain name and certificate to spoof legitimate site] This optional step can be used to help the adversary impersonate the legitimate site more convincingly. The adversary can use homograph or..."}, {"step": "2", "phase": "Explore", "description": "[Explore legitimate website and create duplicate] An adversary creates a website (optionally at a URL that looks similar to the original URL) that closely resembles the website that they are trying to..."}, {"step": "3", "phase": "Exploit", "description": "[Convince user to enter sensitive information on adversary's site.] An adversary sends a text message to the victim that has a call-to-action, in order to persuade the user into clicking the included ..."}, {"step": "4", "phase": "Exploit", "description": "[Use stolen credentials to log into legitimate site] Once the adversary captures some sensitive information through phishing (login credentials, credit card information, etc.) the adversary can levera..."}], "examples": ["The target receives a text message stating that their Apple ID has been disabled due to suspicious activity and that they need to click on the link included in the message to log into their Apple account in order to enable it. The link in the text message looks legitimate and once the link is clicke..."], "related_cwes": ["CWE-451"]}, "165": {"name": "File Manipulation", "abstraction": "Meta", "status": "Draft", "description": "An attacker modifies file contents or attributes (such as extensions or names) of files in a manner to cause incorrect processing by an application. Attackers use this class of attacks to cause applications to enter unstable states, overwrite or expose sensitive information, and even execute arbitrary code with the application's privileges. This class of attacks differs from attacks on configuration information (even if file-based) in that file manipulation causes the file processing to result i...", "severity": "Medium", "prerequisites": ["The target must use the affected file without verifying its integrity."]}, "166": {"name": "Force the System to Reset Values", "abstraction": "Standard", "status": "Draft", "description": "An attacker forces the target into a previous state in order to leverage potential weaknesses in the target dependent upon a prior configuration or state-dependent factors. Even in cases where an attacker may not be able to directly control the configuration of the targeted application, they may be able to reset the configuration to a prior state since many applications implement reset functions.", "severity": "Medium", "prerequisites": ["The targeted application must have a reset function that returns the configuration of the application to an earlier state.", "The reset functionality must be inadequately protected against use."], "related_cwes": ["CWE-306", "CWE-1221", "CWE-1232"]}, "167": {"name": "White Box Reverse Engineering", "abstraction": "Standard", "status": "Draft", "description": "An attacker discovers the structure, function, and composition of a type of computer software through white box analysis techniques. White box techniques involve methods which can be applied to a piece of software when an executable or some other compiled object can be directly subjected to analysis, revealing at least a portion of its machine instructions that can be observed upon execution.", "severity": "Medium", "prerequisites": ["Direct access to the object or software."], "related_cwes": ["CWE-1323"]}, "168": {"name": "Windows ::DATA Alternate Data Stream", "abstraction": "Detailed", "status": "Draft", "description": "An attacker exploits the functionality of Microsoft NTFS Alternate Data Streams (ADS) to undermine system security. ADS allows multiple \"files\" to be stored in one directory entry referenced as filename:streamname. One or more alternate data streams may be stored in any file or directory. Normal Microsoft utilities do not show the presence of an ADS stream attached to a file. The additional space for the ADS is not recorded in the displayed file size. The additional space for ADS is accounted fo...", "severity": "Medium", "prerequisites": ["The target must be running the Microsoft NTFS file system."], "related_cwes": ["CWE-212", "CWE-69"]}, "169": {"name": "Footprinting", "abstraction": "Meta", "status": "Stable", "description": "An adversary engages in probing and exploration activities to identify constituents and properties of the target.", "likelihood": "High", "severity": "Very Low", "prerequisites": ["An application must publicize identifiable information about the system or application through voluntary or involuntary means. Certain identification details of information systems are visible on comm..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Request Footprinting] The attacker examines the website information and source code of the website and uses automated tools to get as much information as possible about the system and organization."}], "examples": ["In this example let us look at the website http://www.example.com to get much information we can about Alice. From the website, we find that Alice also runs foobar.org. We type in www example.com into the prompt of the Name Lookup window in a tool, and our result is this IP address: 192.173.28.130 W..."], "related_cwes": ["CWE-200"]}, "17": {"name": "Using Malicious Files", "abstraction": "Standard", "status": "Draft", "description": "An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges f...", "likelihood": "High", "severity": "Very High", "prerequisites": ["System's configuration must allow an attacker to directly access executable files or upload files to execute. This means that any access control system that is supposed to mediate communications betwe..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine File/Directory Configuration] The adversary looks for misconfigured files or directories on a system that might give executable access to an overly broad group of users."}, {"step": "2", "phase": "Experiment", "description": "[Upload Malicious Files] If the adversary discovers a directory that has executable permissions, they will attempt to upload a malicious file to execute."}, {"step": "3", "phase": "Exploit", "description": "[Execute Malicious File] The adversary either executes the uploaded malicious file, or executes an existing file that has been misconfigured to allow executable access to the adversary."}], "related_cwes": ["CWE-732", "CWE-285", "CWE-272", "CWE-59", "CWE-282", "CWE-270", "CWE-693"]}, "170": {"name": "Web Application Fingerprinting", "abstraction": "Detailed", "status": "Draft", "description": "An attacker sends a series of probes to a web application in order to elicit version-dependent and type-dependent behavior that assists in identifying the target. An attacker could learn information such as software versions, error pages, and response headers, variations in implementations of the HTTP protocol, directory structures, and other similar information about the targeted service. This information can then be used by an attacker to formulate a targeted attack plan. While web application...", "likelihood": "High", "severity": "Low", "prerequisites": ["Any web application can be fingerprinted. However, some configuration choices can limit the useful information an attacker may collect during a fingerprinting attack."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Request fingerprinting] Use automated tools or send web server specific commands to web server and wait for server's response."}, {"step": "2", "phase": "Experiment", "description": "[Increase the accuracy of server fingerprinting of Web servers] Attacker usually needs to send several different commands to accurately identify the web server. Attacker can also use automated tools t..."}, {"step": "3", "phase": "Experiment", "description": "[Identify Web Application Software] After the web server platform software has been identified, the attacker start to identify web application technologies such as ASP, .NET, PHP and Java on the serve..."}, {"step": "4", "phase": "Experiment", "description": "[Identify Backend Database Version] Determining the database engine type can assist attackers' attempt to successfully execute SQL injection. Some database API such as ODBC will show a database type a..."}], "related_cwes": ["CWE-497"]}, "171": {"name": "DEPRECATED: Variable Manipulation", "abstraction": "Meta", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of the existing attack pattern \"CAPEC-77 : Manipulating User-Controlled Variables\". Please refer to this other CAPEC going forward."}, "173": {"name": "Action Spoofing", "abstraction": "Meta", "status": "Stable", "description": "An adversary is able to disguise one action for another and therefore trick a user into initiating one type of action when they intend to initiate a different action. For example, a user might be led to believe that clicking a button will submit a query, but in fact it downloads software. Adversaries may perform this attack through social means, such as by simply convincing a victim to perform the action or relying on a user's natural inclination to do so, or through technical means, such as a c...", "likelihood": "High", "severity": "Very High", "prerequisites": ["The adversary must convince the victim into performing the decoy action.", "The adversary must have the means to control a user's interface to present them with a decoy action as well as the actual malicious action. Simple versions of this attack can be performed using web pa..."], "related_cwes": ["CWE-451"]}, "174": {"name": "Flash Parameter Injection", "abstraction": "Detailed", "status": "Draft", "description": "An adversary takes advantage of improper data validation to inject malicious global parameters into a Flash file embedded within an HTML document. Flash files can leverage user-submitted data to configure the Flash document and access the embedding HTML document.", "likelihood": "High", "severity": "Medium", "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Spider] Using a browser or an automated tool, an adversary records all instances of HTML documents that have embedded Flash files. If there is an embedded Flash file, they list how to pass global par..."}, {"step": "2", "phase": "Experiment", "description": "[Determine the application susceptibility to Flash parameter injection] Determine the application susceptibility to Flash parameter injection. For each URL identified in the Explore phase, the adversa..."}, {"step": "3", "phase": "Exploit", "description": "[Execute Flash Parameter Injection Attack] Inject parameters into Flash file. Based on the results of the Experiment phase, the adversary crafts the underlying malicious URL containing injected Flash ..."}], "related_cwes": ["CWE-88"]}, "175": {"name": "Code Inclusion", "abstraction": "Meta", "status": "Stable", "description": "An adversary exploits a weakness on the target to force arbitrary code to be retrieved locally or from a remote location and executed. This differs from code injection in that code injection involves the direct inclusion of code while code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.", "likelihood": "Medium", "severity": "Very High", "prerequisites": ["The target application must include external code/libraries that are executed when the application runs and the adversary must be able to influence the specific files that get included.", "The victim must run the targeted application, possibly using the crafted parameters that the adversary uses to identify the code to include."], "examples": ["One example of this type of attack pattern is PHP file include attacks where the parameter of an include() function is set by a variable that an attacker is able to control. The result is that arbitrary code could be loaded into the PHP application and executed."], "related_cwes": ["CWE-829"]}, "176": {"name": "Configuration/Environment Manipulation", "abstraction": "Meta", "status": "Draft", "description": "An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack.", "severity": "Medium", "prerequisites": ["The target application must consult external files or configuration controls to control its execution. All but the very simplest applications meet this requirement."], "related_cwes": ["CWE-15", "CWE-1233", "CWE-1234", "CWE-1304", "CWE-1328"]}, "177": {"name": "Create files with the same name as files protected with a higher classification", "abstraction": "Detailed", "status": "Draft", "description": "An attacker exploits file location algorithms in an operating system or application by creating a file with the same name as a protected or privileged file. The attacker could manipulate the system if the attacker-created file is trusted by the operating system or an application component that attempts to load the original file. Applications often load or include external files, such as libraries or configuration files. These files should be protected against malicious manipulation. However, if ...", "severity": "Very High", "prerequisites": ["The target application must include external files. Most non-trivial applications meet this criterion.", "The target application does not verify that a located file is the one it was looking for through means other than the name. Many applications fail to perform checks of this type.", "The directories the target application searches to find the included file include directories writable by the attacker which are searched before the protected directory containing the actual files. It..."], "related_cwes": ["CWE-706"]}, "178": {"name": "Cross-Site Flashing", "abstraction": "Detailed", "status": "Draft", "description": "An attacker is able to trick the victim into executing a Flash document that passes commands or calls to a Flash player browser plugin, allowing the attacker to exploit native Flash functionality in the client browser. This attack pattern occurs where an attacker can provide a crafted link to a Flash document (SWF file) which, when followed, will cause additional malicious instructions to be executed. The attacker does not need to serve or control the Flash document. The attack takes advantage o...", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The targeted Flash application must reference external URLs and the locations thus referenced must be controllable through parameters. The Flash application must fail to sanitize such parameters again..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identification] Using a browser or an automated tool, an attacker records all instances of URLs (or partial URL such as domain) passed to a flash file (SWF)."}, {"step": "2", "phase": "Experiment", "description": "[Attempt to inject a remote flash file] The attacker makes use of a remotely available flash file (SWF) that generates a uniquely identifiable output when executed inside the targeted flash file."}, {"step": "3", "phase": "Exploit", "description": "[Access or Modify Flash Application Variables] As the attacker succeeds in exploiting the vulnerability, they target the content of the flash application to steal variable content, password, etc."}, {"step": "4", "phase": "Exploit", "description": "[Execute JavaScript in victim's browser] When the attacker targets the current flash application, they can choose to inject JavaScript in the client's DOM and therefore execute cross-site scripting at..."}], "examples": ["The attacker tries to get their malicious flash movie to be executed in the targeted flash application. The malicious file is hosted on the attacker.com domain and the targeted flash application is hosted on example.com The crossdomain.xml file in the root of example.com allows all domains and no sp..."], "related_cwes": ["CWE-601"]}, "179": {"name": "Calling Micro-Services Directly", "abstraction": "Standard", "status": "Draft", "description": "An attacker is able to discover and query Micro-services at a web location and thereby expose the Micro-services to further exploitation by gathering information about their implementation and function. Micro-services in web pages allow portions of a page to connect to the server and update content without needing to cause the entire page to update. This allows user activity to change portions of the page more quickly without causing disruptions elsewhere.", "severity": "Medium", "prerequisites": ["The target site must use micro-services that interact with the server and one or more of these micro-services must be vulnerable to some other attack pattern."]}, "18": {"name": "XSS Targeting Non-Script Elements", "abstraction": "Detailed", "status": "Draft", "description": "This attack is a form of Cross-Site Scripting (XSS) where malicious scripts are embedded in elements that are not expected to host scripts such as image tags (<img>), comments in XML documents (< !-CDATA->), etc. These tags may not be subject to the same input validation, output validation, and other content filtering and checking routines, so this can create an opportunity for an adversary to tunnel through the application's elements and launch a XSS attack through other elements. As with all r...", "likelihood": "High", "severity": "Very High", "prerequisites": ["The target client software must allow the execution of scripts generated by remote hosts."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser or an automated tool, an adversary records all entry points for inputs that happen to be reflected in a client-side non-script ele..."}, {"step": "2", "phase": "Experiment", "description": "[Probe identified potential entry points for XSS vulnerability] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and injects various common script payloads to deter..."}, {"step": "3", "phase": "Experiment", "description": "[Create malicious XSS content] Once the adversary has determined which entry points are vulnerable to XSS, they will interact with the web application to store the malicious content. Because of the na..."}, {"step": "4", "phase": "Exploit", "description": "[Get victim to view stored content] In order for the attack to be successful, the victim needs to view the stored malicious content on the webpage."}], "related_cwes": ["CWE-80"]}, "180": {"name": "Exploiting Incorrectly Configured Access Control Security Levels", "abstraction": "Standard", "status": "Draft", "description": "An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security sett...", "likelihood": "High", "severity": "Medium", "prerequisites": ["The target must apply access controls, but incorrectly configure them. However, not all incorrect configurations can be exploited by an attacker. If the incorrect configuration applies too little secu..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey] The attacker surveys the target application, possibly as a valid and authenticated user."}, {"step": "2", "phase": "Experiment", "description": "[Identify weak points in access control configurations] The attacker probes the access control for functions and data identified in the Explore phase to identify potential weaknesses in how the access..."}, {"step": "3", "phase": "Exploit", "description": "[Access the function or data bypassing the access control] The attacker executes the function or accesses the data identified in the Explore phase bypassing the access control."}], "examples": ["For example, an incorrectly configured Web server, may allow unauthorized access to it, thus threaten the security of the Web application."], "related_cwes": ["CWE-732", "CWE-1190", "CWE-1191", "CWE-1193", "CWE-1220", "CWE-1268", "CWE-1280", "CWE-1297", "CWE-1311", "CWE-1315", "CWE-1318", "CWE-1320", "CWE-1321"]}, "181": {"name": "Flash File Overlay", "abstraction": "Detailed", "status": "Draft", "description": "An attacker creates a transparent overlay using flash in order to intercept user actions for the purpose of performing a clickjacking attack. In this technique, the Flash file provides a transparent overlay over HTML content. Because the Flash application is on top of the content, user actions, such as clicks, are caught by the Flash application rather than the underlying HTML. The action is then interpreted by the overlay to perform the actions the attacker wishes.", "severity": "Medium", "prerequisites": ["The victim must be tricked into navigating to the attackers' decoy site and performing the actions on the decoy page.", "The victim's browser must support invisible Flash overlays."], "related_cwes": ["CWE-1021"]}, "182": {"name": "Flash Injection", "abstraction": "Standard", "status": "Draft", "description": "An attacker tricks a victim to execute malicious flash content that executes commands or makes flash calls specified by the attacker. One example of this attack is cross-site flashing, an attacker controlled parameter to a reference call loads from content specified by the attacker.", "likelihood": "High", "severity": "Medium", "prerequisites": ["The target must be capable of running Flash applications. In some cases, the victim must follow an attacker-supplied link."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find Injection Entry Points] The attacker first takes an inventory of the entry points of the application."}, {"step": "2", "phase": "Experiment", "description": "[Determine the application's susceptibility to Flash injection] Determine the application's susceptibility to Flash injection. For each URL identified in the explore phase, the attacker attempts to us..."}, {"step": "3", "phase": "Exploit", "description": "[Inject malicious content into target] Inject malicious content into target utilizing vulnerable injection vectors identified in the Experiment phase"}], "related_cwes": ["CWE-20", "CWE-184", "CWE-697"]}, "183": {"name": "IMAP/SMTP Command Injection", "abstraction": "Standard", "status": "Draft", "description": "An adversary exploits weaknesses in input validation on web-mail servers to execute commands on the IMAP/SMTP server. Web-mail servers often sit between the Internet and the IMAP or SMTP mail server. User requests are received by the web-mail servers which then query the back-end mail server for the requested information and return this response to the user. In an IMAP/SMTP command injection attack, mail-server commands are embedded in parts of the request sent to the web-mail server. If the web...", "severity": "Medium", "prerequisites": ["The target environment must consist of a web-mail server that the attacker can query and a back-end mail server. The back-end mail server need not be directly accessible to the attacker.", "The web-mail server must fail to adequately sanitize fields received from users and passed on to the back-end mail server.", "The back-end mail server must not be adequately secured against receiving malicious commands from the web-mail server."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify Target Web-Mail Server] The adversary first identifies the web-mail server they wish to exploit."}, {"step": "2", "phase": "Experiment", "description": "[Identify Vulnerable Parameters] Once the adversary has identified a web-mail server, they identify any vulnerable parameters by altering their values in requests. The adversary knows that the paramet..."}, {"step": "3", "phase": "Experiment", "description": "[Determine Level of Injection] After identifying all vulnerable parameters, the adversary determines what level of injection is possible."}, {"step": "4", "phase": "Exploit", "description": "[Inject IMAP/SMTP Commands] The adversary manipulates the vulnerable parameters to inject an IMAP/SMTP command and execute it on the mail-server."}], "related_cwes": ["CWE-77"]}, "184": {"name": "Software Integrity Attack", "abstraction": "Meta", "status": "Draft", "description": "An attacker initiates a series of events designed to cause a user, program, server, or device to perform actions which undermine the integrity of software code, device data structures, or device firmware, achieving the modification of the target's integrity to achieve an insecure state.", "severity": "Low", "related_cwes": ["CWE-494"]}, "185": {"name": "Malicious Software Download", "abstraction": "Standard", "status": "Draft", "description": "An attacker uses deceptive methods to cause a user or an automated process to download and install dangerous code that originates from an attacker controlled source. There are several variations to this strategy of attack.", "severity": "Very High", "related_cwes": ["CWE-494"]}, "186": {"name": "Malicious Software Update", "abstraction": "Standard", "status": "Draft", "description": "An adversary uses deceptive methods to cause a user or an automated process to download and install dangerous code believed to be a valid update that originates from an adversary controlled source.", "severity": "High", "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target] The adversary must first identify what they want their target to be. Because malicious software updates can be carried out in a variety of ways, the adversary will first not only ide..."}, {"step": "2", "phase": "Experiment", "description": "[Craft a deployment mechanism based on the target] The adversary must craft a deployment mechanism to deploy the malicious software update. This mechanism will differ based on if the attack is targete..."}, {"step": "3", "phase": "Exploit", "description": "[Deploy malicious software update] Using the deployment mechanism from the previous step, the adversary gets a user to install the malicious software update."}], "examples": ["Using an automated process to download and install dangerous code was key part of the NotPeyta attack [REF-697]"], "related_cwes": ["CWE-494"]}, "187": {"name": "Malicious Automated Software Update via Redirection", "abstraction": "Detailed", "status": "Draft", "description": "An attacker exploits two layers of weaknesses in server or client software for automated update mechanisms to undermine the integrity of the target code-base. The first weakness involves a failure to properly authenticate a server as a source of update or patch content. This type of weakness typically results from authentication mechanisms which can be defeated, allowing a hostile server to satisfy the criteria that establish a trust relationship. The second weakness is a systemic failure to val...", "likelihood": "High", "severity": "High", "related_cwes": ["CWE-494"]}, "188": {"name": "Reverse Engineering", "abstraction": "Meta", "status": "Stable", "description": "An adversary discovers the structure, function, and composition of an object, resource, or system by using a variety of analysis techniques to effectively determine how the analyzed entity was constructed or operates. The goal of reverse engineering is often to duplicate the function, or a part of the function, of an object in order to duplicate or \"back engineer\" some aspect of its functioning. Reverse engineering techniques can be applied to mechanical objects, electronic devices, or software,...", "likelihood": "Low", "severity": "Low", "prerequisites": ["Access to targeted system, resources, and information."], "examples": ["When adversaries are reverse engineering software, methodologies fall into two broad categories, 'white box' and 'black box.' White box techniques involve methods which can be applied to a piece of software when an executable or some other compiled object can be directly subjected to analysis, revea..."], "related_cwes": ["CWE-1278"]}, "189": {"name": "Black Box Reverse Engineering", "abstraction": "Standard", "status": "Draft", "description": "An adversary discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs. Black Box Reverse Engineering also re...", "severity": "Low", "related_cwes": ["CWE-203", "CWE-1255", "CWE-1300"]}, "19": {"name": "Embedding Scripts within Scripts", "abstraction": "Standard", "status": "Stable", "description": "An adversary leverages the capability to execute their own script by embedding it within other scripts that the target software is likely to execute due to programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts.", "likelihood": "High", "severity": "High", "prerequisites": ["Target software must be able to execute scripts, and also grant the adversary privilege to write/upload scripts."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Spider] Using a browser or an automated tool, an adversary records all entry points for inputs that happen to be reflected in a client-side script element. These script elements can be located in the..."}, {"step": "2", "phase": "Experiment", "description": "[Probe identified potential entry points for XSS vulnerability] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and injects various common script payloads to deter..."}, {"step": "3", "phase": "Exploit", "description": "[Steal session IDs, credentials, page content, etc.] As the adversary succeeds in exploiting the vulnerability, they can choose to steal user's credentials in order to reuse or to analyze them later o..."}, {"step": "4", "phase": "Exploit", "description": "[Forceful browsing] When the adversary targets the current application or another one (through CSRF vulnerabilities), the user will then be the one who perform the attacks without being aware of it. T..."}, {"step": "5", "phase": "Exploit", "description": "[Content spoofing] By manipulating the content, the adversary targets the information that the user would like to get from the website."}], "examples": ["~/.bash_profile and ~/.bashrc are executed in a user's context when a new shell opens or when a user logs in so that their environment is set correctly. ~/.bash_profile is executed for login shells and ~/.bashrc is executed for interactive non-login shells. This means that when a user logs in (via u..."], "related_cwes": ["CWE-284"]}, "190": {"name": "Reverse Engineer an Executable to Expose Assumed Hidden Functionality", "abstraction": "Detailed", "status": "Draft", "description": "An attacker analyzes a binary file or executable for the purpose of discovering the structure, function, and possibly source-code of the file by using a variety of analysis techniques to effectively determine how the software functions and operates. This type of analysis is also referred to as Reverse Code Engineering, as techniques exist for extracting source code from an executable. Several techniques are often employed for this purpose, both black box and white box. The use of computer bus an...", "severity": "Low", "related_cwes": ["CWE-912"]}, "191": {"name": "Read Sensitive Constants Within an Executable", "abstraction": "Detailed", "status": "Draft", "severity": "Low", "prerequisites": ["Access to a binary or executable such that it can be analyzed by various utilities."], "related_cwes": ["CWE-798"]}, "192": {"name": "Protocol Analysis", "abstraction": "Meta", "status": "Stable", "description": "An adversary engages in activities to decipher and/or decode protocol information for a network or application communication protocol used for transmitting information between interconnected nodes or systems on a packet-switched data network. While this type of analysis involves the analysis of a networking protocol inherently, it does not require the presence of an actual or physical network.", "likelihood": "Low", "severity": "Low", "prerequisites": ["Access to a binary executable.", "The ability to observe and interact with a communication channel between communicating processes."], "related_cwes": ["CWE-326"]}, "193": {"name": "PHP Remote File Inclusion", "abstraction": "Detailed", "status": "Draft", "description": "In this pattern the adversary is able to load and execute arbitrary code remotely available from the application. This is usually accomplished through an insecurely configured PHP runtime environment and an improperly sanitized \"include\" or \"require\" call, which the user can then control to point to any web-accessible file. This allows adversaries to hijack the targeted application and force it to execute their own instructions.", "likelihood": "High", "severity": "High", "prerequisites": ["Target application server must allow remote files to be included in the \"require\", \"include\", etc. PHP directives", "The adversary must have the ability to make HTTP requests to the target web application."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey application] Using a browser or an automated tool, an adversary follows all public links on a web site. They record all the links they find."}, {"step": "2", "phase": "Experiment", "description": "[Attempt variations on input parameters] The attack variants make use of a remotely available PHP script that generates a uniquely identifiable output when executed on the target application server. P..."}, {"step": "3", "phase": "Exploit", "description": "[Run arbitrary server-side code] As the adversary succeeds in exploiting the vulnerability, they are able to execute server-side code within the application. The malicious code has virtual access to t..."}], "related_cwes": ["CWE-98", "CWE-80"]}, "194": {"name": "Fake the Source of Data", "abstraction": "Standard", "status": "Stable", "description": "An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified \"From\" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case ...", "severity": "Medium", "prerequisites": ["This attack is only applicable when a vulnerable entity associates data or services with an identity. Without such an association, there would be no reason to fake the source."], "related_cwes": ["CWE-287"]}, "195": {"name": "Principal Spoof", "abstraction": "Standard", "status": "Draft", "description": "A Principal Spoof is a form of Identity Spoofing where an adversary pretends to be some other person in an interaction. This is often accomplished by crafting a message (either written, verbal, or visual) that appears to come from a person other than the adversary. Phishing and Pharming attacks often attempt to do this so that their attempts to gather sensitive information appear to come from a legitimate source. A Principal Spoof does not use stolen or spoofed authentication credentials, instea...", "severity": "Medium", "prerequisites": ["The target must associate data or activities with a person's identity and the adversary must be able to modify this identity without detection."]}, "196": {"name": "Session Credential Falsification through Forging", "abstraction": "Standard", "status": "Draft", "description": "An attacker creates a false but functional session credential in order to gain or usurp access to a service. Session credentials allow users to identify themselves to a service after an initial authentication without needing to resend the authentication information (usually a username and password) with every message. If an attacker is able to forge valid session credentials they may be able to bypass authentication or piggy-back off some other authenticated user's session. This attack differs f...", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The targeted application must use session credentials to identify legitimate users. Session identifiers that remains unchanged when the privilege levels change. Predictable session identifiers."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Analyze and Understand Session IDs] The attacker finds that the targeted application use session credentials to identify legitimate users."}, {"step": "2", "phase": "Experiment", "description": "[Create Session IDs.] Attackers craft messages containing their forged credentials in GET, POST request, HTTP headers or cookies."}, {"step": "3", "phase": "Exploit", "description": "[Abuse the Victim's Session Credentials] The attacker fixates falsified session ID to the victim when victim access the system. Once the victim has achieved a higher level of privilege, possibly by lo..."}], "related_cwes": ["CWE-384", "CWE-664"]}, "197": {"name": "Exponential Data Expansion", "abstraction": "Detailed", "status": "Draft", "description": "An adversary submits data to a target application which contains nested exponential data expansion to produce excessively large output. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.", "likelihood": "High", "severity": "Medium", "prerequisites": ["This type of attack requires that the target must receive input but either fail to provide an upper limit for entity expansion or provide a limit that is so large that it does not preclude significant..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the target] An adversary determines the input data stream that is being processed by a data parser that supports using subsitituion on the victim's side."}, {"step": "2", "phase": "Experiment", "description": "[Craft malicious payload] The adversary crafts a malicious message containing nested exponential expansion that completely uses up available server resources. See the \"Example Instances\" section for d..."}, {"step": "3", "phase": "Exploit", "description": "[Send the message] Send the malicious crafted message to the target URL."}], "related_cwes": ["CWE-770", "CWE-776"]}, "198": {"name": "XSS Targeting Error Pages", "abstraction": "Detailed", "status": "Draft", "description": "An adversary distributes a link (or possibly some other query structure) with a request to a third party web server that is malformed and also contains a block of exploit code in order to have the exploit become live code in the resulting error page.", "severity": "Medium", "prerequisites": ["A third party web server which fails to adequately sanitize messages sent in error pages.", "The victim must be made to execute a query crafted by the adversary which results in the infected error report."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs as URL parameters] Using a browser or an automated tool, an adversary follows all public links and actions on a web site. They record all the links..."}, {"step": "2", "phase": "Experiment", "description": "[Cause application to return error page] The adversary uses the URLs gathered in the \"Explore\" phase as a target list and injects various common script payloads and special characters into the paramet..."}, {"step": "3", "phase": "Experiment", "description": "[Craft malicious XSS URL] Once the adversary has determined which parameters are vulnerable to XSS through an error page, they will craft a malicious URL containing the XSS exploit. The adversary can ..."}, {"step": "4", "phase": "Exploit", "description": "[Get victim to click URL] In order for the attack to be successful, the victim needs to access the malicious URL."}], "related_cwes": ["CWE-81"]}, "199": {"name": "XSS Using Alternate Syntax", "abstraction": "Detailed", "status": "Draft", "description": "An adversary uses alternate forms of keywords or commands that result in the same action as the primary form but which may not be caught by filters. For example, many keywords are processed in a case insensitive manner. If the site's web filtering algorithm does not convert all tags into a consistent case before the comparison with forbidden keywords it is possible to bypass filters (e.g., incomplete black lists) by using an alternate case structure. For example, the \"script\" tag using the alter...", "likelihood": "High", "severity": "High", "prerequisites": ["Target client software must allow scripting such as JavaScript."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser or an automated tool, an adversary follows all public links and actions on a web site. They record all the links, the forms, the r..."}, {"step": "2", "phase": "Experiment", "description": "[Probe identified potential entry points for XSS vulnerability] Possibly using an automated tool, an adversary requests variations on the inputs they surveyed before using alternate syntax. These inpu..."}, {"step": "3", "phase": "Experiment", "description": "[Craft malicious XSS URL] Once the adversary has determined which parameters are vulnerable to XSS, they will craft a malicious URL containing the XSS exploit. The adversary can have many goals, from ..."}, {"step": "4", "phase": "Exploit", "description": "[Get victim to click URL] In order for the attack to be successful, the victim needs to access the malicious URL."}], "related_cwes": ["CWE-87"]}, "2": {"name": "Inducing Account Lockout", "abstraction": "Standard", "status": "Draft", "description": "An attacker leverages the security functionality of the system aimed at thwarting potential attacks to launch a denial of service attack against a legitimate system user. Many systems, for instance, implement a password throttling mechanism that locks an account after a certain number of incorrect log in attempts. An attacker can leverage this throttling mechanism to lock a legitimate user out of their own account. The weakness that is being leveraged by an attacker is the very security feature ...", "likelihood": "High", "severity": "Medium", "prerequisites": ["The system has a lockout mechanism.", "An attacker must be able to reproduce behavior that would result in an account being locked."], "execution_flow": [{"step": "1", "phase": "Experiment", "description": "[Investigate account lockout behavior of system] Investigate the security features present in the system that may trigger an account lockout"}, {"step": "2", "phase": "Experiment", "description": "[Obtain list of user accounts to lock out] Generate a list of valid user accounts to lock out"}, {"step": "3", "phase": "Exploit", "description": "[Lock Out Accounts] Perform lockout procedure for all accounts that the attacker wants to lock out."}], "examples": ["A famous example of this type an attack is the eBay attack. eBay always displays the user id of the highest bidder. In the final minutes of the auction, one of the bidders could try to log in as the highest bidder three times. After three incorrect log in attempts, eBay password throttling would kic..."], "related_cwes": ["CWE-645"]}, "20": {"name": "Encryption Brute Forcing", "abstraction": "Standard", "status": "Draft", "description": "An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.", "likelihood": "Low", "severity": "Low", "prerequisites": ["Ciphertext is known.", "Encryption algorithm and key size are known."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "Determine the ciphertext and the encryption algorithm."}, {"step": "2", "phase": "Experiment", "description": "Perform an exhaustive brute force search of the key space, producing candidate plaintexts and observing if they make sense."}], "examples": ["In 1997 the original DES challenge used distributed net computing to brute force the encryption key and decrypt the ciphertext to obtain the original plaintext. Each machine was given its own section of the key space to cover. The ciphertext was decrypted in 96 days."], "related_cwes": ["CWE-326", "CWE-327", "CWE-693", "CWE-1204"]}, "200": {"name": "Removal of filters: Input filters, output filters, data masking", "abstraction": "Detailed", "status": "Draft", "description": "An attacker removes or disables filtering mechanisms on the target application. Input filters prevent invalid data from being sent to an application (for example, overly large inputs that might cause a buffer overflow or other malformed inputs that may not be correctly handled by an application). Input filters might also be designed to constrained executable content.", "severity": "Medium", "prerequisites": ["The target application must utilize some sort of filtering mechanism (input, output, or data masking)."]}, "201": {"name": "Serialized Data External Linking", "abstraction": "Detailed", "status": "Draft", "description": "An adversary creates a serialized data file (e.g. XML, YAML, etc...) that contains an external data reference. Because serialized data parsers may not validate documents with external references, there may be no checks on the nature of the reference in the external data. This can allow an adversary to open arbitrary files or connections, which may further lead to the adversary gaining access to information on the system that they would normally be unable to obtain.", "likelihood": "High", "severity": "High", "prerequisites": ["The target must follow external data references without validating the validity of the reference target."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the target] Using a browser or an automated tool, an adversary records all instances of web services that process requests with serialized data."}, {"step": "2", "phase": "Exploit", "description": "[Craft malicious payload] The adversary crafts malicious data message that contains references to sensitive files."}, {"step": "3", "phase": "Exploit", "description": "[Launch an External Linking attack] Send the malicious crafted message containing the reference to a sensitive file to the target URL."}], "related_cwes": ["CWE-829"]}, "202": {"name": "Create Malicious Client", "abstraction": "Standard", "status": "Draft", "description": "An adversary creates a client application to interface with a target service where the client violates assumptions the service makes about clients. Services that have designated client applications (as opposed to services that use general client applications, such as IMAP or POP mail servers which can interact with any IMAP or POP client) may assume that the client will follow specific procedures.", "severity": "Medium", "prerequisites": ["The targeted service must make assumptions about the behavior of the client application that interacts with it, which can be abused by an adversary."], "related_cwes": ["CWE-602"]}, "203": {"name": "Manipulate Registry Information", "abstraction": "Standard", "status": "Stable", "description": "An adversary exploits a weakness in authorization in order to modify content within a registry (e.g., Windows Registry, Mac plist, application registry). Editing registry information can permit the adversary to hide configuration information or remove indicators of compromise to cover up activity. Many applications utilize registries to store configuration and service information. As such, modification of registry information can affect individual services (affecting billing, authorization, or e...", "severity": "Medium", "prerequisites": ["The targeted application must rely on values stored in a registry.", "The adversary must have a means of elevating permissions in order to access and modify registry content through either administrator privileges (e.g., credentialed access), or a remote access tool cap..."], "examples": ["Manipulating registration information can be undertaken in advance of a path traversal attack (inserting relative path modifiers) or buffer overflow attack (enlarging a registry value beyond an application's ability to store it)."], "related_cwes": ["CWE-15"]}, "204": {"name": "Lifting Sensitive Data Embedded in Cache", "abstraction": "Detailed", "status": "Draft", "description": "An adversary examines a target application's cache, or a browser cache, for sensitive information. Many applications that communicate with remote entities or which perform intensive calculations utilize caches to improve efficiency. However, if the application computes or receives sensitive information and the cache is not appropriately protected, an attacker can browse the cache and retrieve this information. This can result in the disclosure of sensitive information.", "severity": "Medium", "prerequisites": ["The target application must store sensitive information in a cache.", "The cache must be inadequately protected against attacker access."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify Application Cache] An adversary first identifies an application that utilizes a cache. This could either be a web application storing data in a browser cache, or an application running on a ..."}, {"step": "2", "phase": "Experiment", "description": "[Attempt to Access Cache] Once the cache has been discovered, the adversary attempts to access the cached data. This often requires previous access to a machine hosting the target application."}, {"step": "3", "phase": "Exploit", "description": "[Lift Sensitive Data from Cache] After gaining access to cached data, an adversary looks for potentially sensitive information and stores it for malicious use. This sensitive data could possibly be us..."}], "related_cwes": ["CWE-524", "CWE-311", "CWE-1239", "CWE-1258"]}, "205": {"name": "DEPRECATED: Lifting credential(s)/key material embedded in client distributions (thick or thin)", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of CAPEC-37 : Retrieve Embedded Sensitive Data. Please refer to this other pattern going forward."}, "206": {"name": "Signing Malicious Code", "abstraction": "Detailed", "status": "Draft", "description": "The adversary extracts credentials used for code signing from a production environment and then uses these credentials to sign malicious content with the developer's key. Many developers use signing keys to sign code or hashes of code. When users or applications verify the signatures are accurate they are led to believe that the code came from the owner of the signing key and that the code has not been modified since the signature was applied. If the adversary has extracted the signing credentia...", "severity": "Very High", "prerequisites": ["The targeted developer must use a signing key to sign code bundles. (Note that not doing this is not a defense - it only means that the adversary does not need to steal the signing key before forging ..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "The adversary first attempts to obtain a digital certificate in order to sign their malware or tools. This certificate could be stolen, created by the adversary, or acquired normally through a certifi..."}, {"step": "2", "phase": "Explore", "description": "Based on the type of certificate obtained, the adversary will create a goal for their attack. This is either a broad or targeted attack. If an adversary was able to steal a certificate from a targeted..."}, {"step": "3", "phase": "Experiment", "description": "The adversary creates their malware and signs it with the obtained digital certificate. The adversary then checks if the code that they signed is valid either through downloading from the targeted sou..."}, {"step": "4", "phase": "Exploit", "description": "Once the malware has been signed, it is then deployed to the desired location. They wait for a trusting user to run their malware, thinking that it is legitimate software. This malware could do a vari..."}], "related_cwes": ["CWE-732"]}, "207": {"name": "Removing Important Client Functionality", "abstraction": "Standard", "status": "Draft", "description": "An adversary removes or disables functionality on the client that the server assumes to be present and trustworthy.", "likelihood": "Medium", "severity": "High", "prerequisites": ["The targeted server must assume the client performs important actions to protect the server or the server functionality. For example, the server may assume the client filters outbound traffic or that ..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Probing] The adversary probes, through brute-forcing, reverse-engineering or other similar means, the functionality on the client that server assumes to be present and trustworthy."}, {"step": "2", "phase": "Experiment", "description": "[Determine which functionality to disable or remove] The adversary tries to determine which functionality to disable or remove through reverse-engineering from the list of functionality identified in ..."}, {"step": "3", "phase": "Exploit", "description": "[Disable or remove the critical functionality from the client code] Once the functionality has been determined, the adversary disables or removes the critical functionality from the client code to per..."}], "examples": ["The adversary reverse engineers a Java binary (by decompiling it) and identifies where license management code exists. Noticing that the license manager returns TRUE or FALSE as to whether or not the user is licensed, the adversary simply overwrites both branch targets to return TRUE, recompiles, an...", "The adversary uses click-through exploration of a Servlet-based website to map out its functionality, taking note of its URL-naming conventions and Servlet mappings. Using this knowledge and guessing the Servlet name of functionality they're not authorized to use, the adversary directly navigates to..."], "related_cwes": ["CWE-602"]}, "208": {"name": "Removing/short-circuiting 'Purse' logic: removing/mutating 'cash' decrements", "abstraction": "Detailed", "status": "Draft", "description": "An attacker removes or modifies the logic on a client associated with monetary calculations resulting in incorrect information being sent to the server. A server may rely on a client to correctly compute monetary information. For example, a server might supply a price for an item and then rely on the client to correctly compute the total cost of a purchase given the number of items the user is buying. If the attacker can remove or modify the logic that controls these calculations, they can retur...", "severity": "Medium", "prerequisites": ["The targeted server must rely on the client to correctly perform monetary calculations and must fail to detect errors in these calculations."], "related_cwes": ["CWE-602"]}, "209": {"name": "XSS Using MIME Type Mismatch", "abstraction": "Detailed", "status": "Draft", "description": "An adversary creates a file with scripting content but where the specified MIME type of the file is such that scripting is not expected. The adversary tricks the victim into accessing a URL that responds with the script file. Some browsers will detect that the specified MIME type of the file does not match the actual type of its content and will automatically switch to using an interpreter for the real content type. If the browser does not invoke script filters before doing this, the adversary's...", "severity": "Medium", "prerequisites": ["The victim must follow a crafted link that references a scripting file that is mis-typed as a non-executable file.", "The victim's browser must detect the true type of a mis-labeled scripting file and invoke the appropriate script interpreter without first performing filtering on the content."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for stored user-controllable inputs] Using a browser or an automated tool, an adversary follows all public links and actions on a web site. They record all areas that allow a u..."}, {"step": "2", "phase": "Experiment", "description": "[Probe identified potential entry points for MIME type mismatch] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and uploads files with scripting content, but whos..."}, {"step": "3", "phase": "Experiment", "description": "[Store malicious XSS content] Once the adversary has determined which file upload locations are vulnerable to MIME type mismatch, they will upload a malicious script disguised as a non scripting file...."}, {"step": "4", "phase": "Exploit", "description": "[Get victim to view stored content] In order for the attack to be successful, the victim needs to view the stored malicious content on the webpage."}], "examples": ["For example, the MIME type text/plain may be used where the actual content is text/javascript or text/html. Since text does not contain scripting instructions, the stated MIME type would indicate that filtering is unnecessary. However, if the target application subsequently determines the file's rea...", "In another example, img tags in HTML content could reference a renderable type file instead of an expected image file. The file extension and MIME type can describe an image file, but the file content can be text/javascript or text/html resulting in script execution. If the browser assumes all refer..."], "related_cwes": ["CWE-79", "CWE-20", "CWE-646"]}, "21": {"name": "Exploitation of Trusted Identifiers", "abstraction": "Meta", "status": "Stable", "likelihood": "High", "severity": "High", "prerequisites": ["Server software must rely on weak identifier proof and/or verification schemes.", "Identifiers must have long lifetimes and potential for reusability.", "Server software must allow concurrent sessions to exist."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for Indicators of Susceptibility] Using a variety of methods, until one is found that applies to the target, the adversary probes for cookies, session tokens, or entry points t..."}, {"step": "2", "phase": "Experiment", "description": "[Fetch samples] The adversary fetches many samples of identifiers. This may be through legitimate access (logging in, legitimate connections, etc.) or via systematic probing."}, {"step": "3", "phase": "Exploit", "description": "[Impersonate] An adversary can use successful experiments or authentications to impersonate an authorized user or system or to laterally move within a system or application"}, {"step": "4", "phase": "Exploit", "description": "[Spoofing] Malicious data can be injected into the target system or into a victim user's system by an adversary. The adversary can also pose as a legitimate user to perform social engineering attacks."}, {"step": "5", "phase": "Exploit", "description": "[Data Exfiltration] The adversary can obtain sensitive data contained within the system or application."}], "examples": ["For example, in a message queuing system that allows service requesters to post messages to its queue through an open channel (such as anonymous FTP), authorization is done through checking group or role membership contained in the posted message. However, there is no proof that the message itself, ..."], "related_cwes": ["CWE-290", "CWE-302", "CWE-346", "CWE-539", "CWE-6", "CWE-384", "CWE-664", "CWE-602", "CWE-642"]}, "211": {"name": "DEPRECATED: Leveraging web tools (e.g. Mozilla's GreaseMonkey, Firebug) to change application behavior", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated as it was deemed not to be a legitimate attack pattern."}, "212": {"name": "Functionality Misuse", "abstraction": "Meta", "status": "Stable", "description": "An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact. The system functionality is not altered or modified but used in a way that was not intended. This is often accomplished through the overuse of a specific functionality or by leveraging functionality with design flaws that enables the adversary to gain access to unauthorized, sensitive data.", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The adversary has the capability to interact with the application directly.The target system does not adequately implement safeguards to prevent misuse of authorized actions/processes."], "related_cwes": ["CWE-1242", "CWE-1246", "CWE-1281"]}, "213": {"name": "DEPRECATED: Directory Traversal", "abstraction": "Standard", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of the existing attack pattern \"CAPEC-126 : Path Traversal\". Please refer to this other CAPEC going forward."}, "214": {"name": "DEPRECATED: Fuzzing for garnering J2EE/.NET-based stack traces, for application mapping", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated as it was merged into \"CAPEC-215 : Fuzzing for application mapping\". Please refer to this other CAPEC going forward."}, "215": {"name": "Fuzzing for application mapping", "abstraction": "Detailed", "status": "Draft", "description": "An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cau...", "likelihood": "High", "severity": "Low", "prerequisites": ["The target application must fail to sanitize incoming messages adequately before processing."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Observe communication and inputs] The fuzzing adversary observes the target system looking for inputs and communications between modules, subsystems, or systems."}, {"step": "2", "phase": "Experiment", "description": "[Generate fuzzed inputs] Given a fuzzing tool, a target input or protocol, and limits on time, complexity, and input variety, generate a list of inputs to try. Although fuzzing is random, it is not ex..."}, {"step": "3", "phase": "Experiment", "description": "[Observe the outcome] Observe the outputs to the inputs fed into the system by fuzzers and see if there are any log or error messages that might provide information to map the application"}, {"step": "4", "phase": "Exploit", "description": "[Craft exploit payloads] An adversary usually needs to modify the fuzzing parameters according to the observed error messages to get the desired sensitive information for the application. To defeat co..."}], "related_cwes": ["CWE-209", "CWE-532"]}, "216": {"name": "Communication Channel Manipulation", "abstraction": "Meta", "status": "Stable", "description": "An adversary manipulates a setting or parameter on communications channel in order to compromise its security. This can result in information exposure, insertion/removal of information from the communications stream, and/or potentially system compromise.", "prerequisites": ["The target application must leverage an open communications channel.", "The channel on which the target communicates must be vulnerable to interception (e.g., adversary in the middle attack - CAPEC-94)."], "related_cwes": ["CWE-306"]}, "217": {"name": "Exploiting Incorrectly Configured SSL/TLS", "abstraction": "Standard", "status": "Draft", "description": "An adversary takes advantage of incorrectly configured SSL/TLS communications that enables access to data intended to be encrypted. The adversary may also use this type of attack to inject commands or other traffic into the encrypted stream to cause compromise of either the client or server.", "likelihood": "Low", "prerequisites": ["Access to the client/server stream."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine SSL/TLS Configuration] Determine the SSL/TLS configuration of either the server or client being targeted, preferably both. This is not a hard requirement, as the adversary can simply assume..."}, {"step": "2", "phase": "Experiment", "description": "[Intercept Communication] Provide controlled access to the server by the client, by either providing a link for the client to click on, or by positioning one's self at a place on the network to interc..."}, {"step": "3", "phase": "Exploit", "description": "[Capture or Manipulate Sensitive Data] Once the adversary has the ability to intercept the secure communication, they exploit the incorrectly configured SSL to view the encrypted communication. The ad..."}], "examples": ["Using MITM techniques, an adversary launches a blockwise chosen-boundary attack to obtain plaintext HTTP headers by taking advantage of an SSL session using an encryption protocol in CBC mode with chained initialization vectors (IV). This allows the adversary to recover session IDs, authentication c..."], "related_cwes": ["CWE-201"]}, "218": {"name": "Spoofing of UDDI/ebXML Messages", "abstraction": "Detailed", "status": "Draft", "description": "An attacker spoofs a UDDI, ebXML, or similar message in order to impersonate a service provider in an e-business transaction. UDDI, ebXML, and similar standards are used to identify businesses in e-business transactions. Among other things, they identify a particular participant, WSDL information for SOAP transactions, and supported communication protocols, including security protocols. By spoofing one of these messages an attacker could impersonate a legitimate business in a transaction or coul...", "severity": "Medium", "prerequisites": ["The targeted business's UDDI or ebXML information must be served from a location that the attacker can spoof or compromise or the attacker must be able to intercept and modify unsecured UDDI/ebXML mes..."], "related_cwes": ["CWE-345"]}, "219": {"name": "XML Routing Detour Attacks", "abstraction": "Standard", "status": "Draft", "description": "An attacker subverts an intermediate system used to process XML content and forces the intermediate to modify and/or re-route the processing of the content. XML Routing Detour Attacks are Adversary in the Middle type attacks (CAPEC-94). The attacker compromises or inserts an intermediate system in the processing of the XML message. For example, WS-Routing can be used to specify a series of nodes or intermediaries through which content is passed. If any of the intermediate nodes in this route are...", "likelihood": "High", "severity": "Medium", "prerequisites": ["The targeted system must have multiple stages processing of XML content."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the target] Using command line or an automated tool, an attacker records all instances of web services to process XML requests."}, {"step": "2", "phase": "Experiment", "description": "[Identify SOAP messages that have multiple state processing.] Inspect instance to see whether the XML processing has multiple stages or not."}, {"step": "3", "phase": "Exploit", "description": "[Launch an XML routing detour attack] The attacker injects a bogus routing node (using a WS-Referral service) into the routing table of the XML header of the SOAP message identified in the Explore pha..."}], "related_cwes": ["CWE-441", "CWE-610"]}, "22": {"name": "Exploiting Trust in Client", "abstraction": "Meta", "status": "Draft", "description": "An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.", "likelihood": "High", "severity": "High", "prerequisites": ["Server software must rely on client side formatted and validated values, and not reinforce these checks on the server side."], "examples": ["Web applications may use JavaScript to perform client side validation, request encoding/formatting, and other security functions, which provides some usability benefits and eliminates some client-server round-tripping. However, the web server cannot assume that the requests it receives have been sub...", "Web 2.0 style applications may be particularly vulnerable because they in large part rely on existing infrastructure which provides scalability without the ability to govern the clients. Attackers identify vulnerabilities that either assume the client side is responsible for some security services (...", "Many web applications use client side scripting like JavaScript to enforce authentication, authorization, session state and other variables, but at the end of day they all make requests to the server. These client side checks may provide usability and performance gains, but they lack integrity in te..."], "related_cwes": ["CWE-290", "CWE-287", "CWE-20", "CWE-200", "CWE-693"]}, "220": {"name": "Client-Server Protocol Manipulation", "abstraction": "Standard", "status": "Draft", "description": "An adversary takes advantage of weaknesses in the protocol by which a client and server are communicating to perform unexpected actions. Communication protocols are necessary to transfer messages between client and server applications. Moreover, different protocols may be used for different types of interactions.", "severity": "Medium", "prerequisites": ["The client and/or server must utilize a protocol that has a weakness allowing manipulation of the interaction."], "related_cwes": ["CWE-757"]}, "221": {"name": "Data Serialization External Entities Blowup", "abstraction": "Detailed", "status": "Draft", "description": "This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.", "prerequisites": ["A server that has an implementation that accepts entities containing URI values."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find target web service] The adversary must first find a web service that takes input data in the form of a serialized language such as XML or YAML."}, {"step": "2", "phase": "Experiment", "description": "[Host malicious file on a server] The adversary will create a web server that contains a malicious file. This file will be extremely large, so that if a web service were to try to load it, the service..."}, {"step": "2", "phase": "Experiment", "description": "[Craft malicious data] Using the serialization language that the web service takes as input, the adversary will craft data that links to the malicious file using an external entity reference to the UR..."}, {"step": "4", "phase": "Exploit", "description": "[Send serialized data containing URI] The adversary will send specially crafted serialized data to the web service. When the web service loads the input, it will attempt to download the malicious file..."}], "related_cwes": ["CWE-611"]}, "222": {"name": "iFrame Overlay", "abstraction": "Detailed", "status": "Draft", "description": "In an iFrame overlay attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from seemingly completely different system.", "likelihood": "Medium", "severity": "High", "prerequisites": ["The victim is communicating with the target application via a web based UI and not a thick client. The victim's browser security policies allow iFrames. The victim uses a modern browser that supports ..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Craft an iFrame Overlay page] The adversary crafts a malicious iFrame overlay page."}, {"step": "2", "phase": "Exploit", "description": "[adversary tricks victim to load the iFrame overlay page] adversary utilizes some form of temptation, misdirection or coercion to trick the victim to loading and interacting with the iFrame overlay pa..."}, {"step": "3", "phase": "Exploit", "description": "[Trick victim into interacting with the iFrame overlay page in the desired manner] The adversary tricks the victim into clicking on the areas of the UI which contain the hidden action controls and the..."}], "examples": ["The following example is a real-world iFrame overlay attack [2]. In this attack, the malicious page embeds Twitter.com on a transparent IFRAME. The status-message field is initialized with the URL of the malicious page itself. To provoke the click, which is necessary to publish the entry, the malici..."], "related_cwes": ["CWE-1021"]}, "224": {"name": "Fingerprinting", "abstraction": "Meta", "status": "Stable", "description": "An adversary compares output from a target system to known indicators that uniquely identify specific details about the target. Most commonly, fingerprinting is done to determine operating system and application versions. Fingerprinting can be done passively as well as actively. Fingerprinting by itself is not usually detrimental to the target. However, the information gathered through fingerprinting often enables an adversary to discover existing weaknesses in the target.", "likelihood": "High", "severity": "Very Low", "prerequisites": ["A means by which to interact with the target system directly."], "related_cwes": ["CWE-200"]}, "226": {"name": "Session Credential Falsification through Manipulation", "abstraction": "Detailed", "status": "Draft", "description": "An attacker manipulates an existing credential in order to gain access to a target application. Session credentials allow users to identify themselves to a service after an initial authentication without needing to resend the authentication information (usually a username and password) with every message. An attacker may be able to manipulate a credential sniffed from an existing connection in order to gain access to a target server.", "severity": "Medium", "prerequisites": ["The targeted application must use session credentials to identify legitimate users."], "related_cwes": ["CWE-565", "CWE-472"]}, "227": {"name": "Sustained Client Engagement", "abstraction": "Meta", "status": "Draft", "description": "An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is s...", "prerequisites": ["This pattern of attack requires a temporal aspect to the servicing of a given request. Success can be achieved if the adversary can make requests that collectively take more time to complete than legi..."], "related_cwes": ["CWE-400"]}, "228": {"name": "DTD Injection", "abstraction": "Detailed", "status": "Draft", "description": "An attacker injects malicious content into an application's DTD in an attempt to produce a negative technical impact. DTDs are used to describe how XML documents are processed. Certain malformed DTDs (for example, those with excessive entity expansion as described in CAPEC 197) can cause the XML parsers that process the DTDs to consume excessive resources resulting in resource depletion.", "severity": "Medium", "prerequisites": ["The target must be running an XML based application that leverages DTDs."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the target] Using a browser or an automated tool, an attacker records all instances of web services to process XML requests."}, {"step": "2", "phase": "Explore", "description": "[Determine use of XML with DTDs] Examine application input to identify XML input that leverage the use of one or more DTDs."}, {"step": "3", "phase": "Exploit", "description": "[Craft and inject XML containg malicious DTD payload]"}], "related_cwes": ["CWE-829"]}, "229": {"name": "Serialized Data Parameter Blowup", "abstraction": "Detailed", "status": "Draft", "description": "This attack exploits certain serialized data parsers (e.g., XML, YAML, etc.) which manage data in an inefficient manner. The attacker crafts an serialized data file with multiple configuration parameters in the same dataset. In a vulnerable parser, this results in a denial of service condition where CPU resources are exhausted because of the parsing algorithm. The weakness being exploited is tied to parser implementation and not language specific.", "likelihood": "High", "severity": "High", "prerequisites": ["The server accepts input in the form of serialized data and is using a parser with a runtime longer than O(n) for the insertion of a new configuration parameter in the data container.(examples are .NE..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the target] Using a browser or an automated tool, an attacker records all instances of web services to process requests using serialized data."}, {"step": "2", "phase": "Exploit", "description": "[Launch a Blowup attack] The attacker crafts malicious messages that contain multiple configuration parameters in the same dataset."}], "related_cwes": ["CWE-770"]}, "23": {"name": "File Content Injection", "abstraction": "Standard", "status": "Draft", "description": "An adversary poisons files with a malicious payload (targeting the file systems accessible by the target software), which may be passed through by standard channels such as via email, and standard web content like PDF and multimedia files. The adversary exploits known vulnerabilities or handling routines in the target processes, in order to exploit the host's trust in executing remote content, including binary files.", "likelihood": "High", "severity": "Very High", "prerequisites": ["The target software must consume files.", "The adversary must have access to modify files that the target software will consume."], "related_cwes": ["CWE-20"]}, "230": {"name": "Serialized Data with Nested Payloads", "abstraction": "Standard", "status": "Draft", "description": "Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more r...", "likelihood": "Medium", "severity": "High", "prerequisites": ["An application's user-controllable data is expressed in a language that supports subsitution.", "An application does not perform sufficient validation to ensure that user-controllable data is not malicious."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "An adversary determines the input data stream that is being processed by a data parser that supports using substitution on the victim's side."}, {"step": "2", "phase": "Exploit", "description": "An adversary crafts input data that may have an adverse effect on the operation of the parser when the data is parsed on the victim's system."}], "related_cwes": ["CWE-112", "CWE-20", "CWE-674", "CWE-770"]}, "231": {"name": "Oversized Serialized Data Payloads", "abstraction": "Standard", "status": "Draft", "description": "An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.", "likelihood": "Medium", "severity": "High", "prerequisites": ["An application uses an parser for serialized data to perform transformation on user-controllable data.", "An application does not perform sufficient validation to ensure that user-controllable data is safe for a data parser."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "An adversary determines the input data stream that is being processed by an serialized data parser on the victim's side."}, {"step": "2", "phase": "Experiment", "description": "An adversary crafts input data that may have an adverse effect on the operation of the data parser when the data is parsed on the victim's system."}], "related_cwes": ["CWE-112", "CWE-20", "CWE-674", "CWE-770"]}, "233": {"name": "Privilege Escalation", "abstraction": "Meta", "status": "Draft", "description": "An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.", "related_cwes": ["CWE-269", "CWE-1264", "CWE-1311"]}, "234": {"name": "Hijacking a privileged process", "abstraction": "Standard", "status": "Draft", "description": "An adversary gains control of a process that is assigned elevated privileges in order to execute arbitrary code with those privileges. Some processes are assigned elevated privileges on an operating system, usually through association with a particular user, group, or role. If an attacker can hijack this process, they will be able to assume its level of privilege in order to execute their own code.", "severity": "Medium", "prerequisites": ["The targeted process or operating system must contain a bug that allows attackers to hijack the targeted process."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find process with elevated priveleges] The adversary probes for processes running with elevated privileges."}, {"step": "2", "phase": "Experiment", "description": "[Find vulnerability in running process] The adversary looks for a vulnerability in the running process that would allow for arbitrary code execution with the privilege of the running process."}, {"step": "3", "phase": "Exploit", "description": "[Execute arbitrary code] The adversary exploits the vulnerability that they have found and hijacks the running process."}], "related_cwes": ["CWE-732", "CWE-648"]}, "235": {"name": "DEPRECATED: Implementing a callback to system routine (old AWT Queue)", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated. Please refer to CAPEC:30 - Hijacking a Privileged Thread of Execution."}, "236": {"name": "DEPRECATED: Catching exception throw/signal from privileged block", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated as it did not have enough distinction from CAPEC-30 : Hijacking a Privileged Thread of Execution. Please refer to CAPEC-30 moving forward."}, "237": {"name": "Escaping a Sandbox by Calling Code in Another Language", "abstraction": "Detailed", "status": "Draft", "description": "The attacker may submit malicious code of another language to obtain access to privileges that were not intentionally exposed by the sandbox, thus escaping the sandbox. For instance, Java code cannot perform unsafe operations, such as modifying arbitrary memory locations, due to restrictions placed on it by the Byte code Verifier and the JVM. If allowed, Java code can call directly into native C code, which may perform unsafe operations, such as call system calls and modify arbitrary memory loca...", "likelihood": "Low", "severity": "Very High", "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Probing] The attacker probes the target application to see whether calling code of another language is allowed within a sandbox."}, {"step": "2", "phase": "Explore", "description": "[Analysis] The attacker analyzes the target application to get a list of cross code weaknesses in the standard libraries of the sandbox."}, {"step": "3", "phase": "Experiment", "description": "[Verify the exploitable security weaknesses] The attacker tries to craft malicious code of another language allowed by the sandbox to verify the security weaknesses of the standard libraries found in ..."}, {"step": "4", "phase": "Exploit", "description": "[Exploit the security weaknesses in the standard libraries] The attacker calls malicious code of another language to exploit the security weaknesses in the standard libraries verified in the Experimen..."}], "examples": ["Exploit: Java/ByteVerify.C is a detection of malicious code that attempts to exploit a vulnerability in the Microsoft Virtual Machine (VM). The VM enables Java programs to run on Windows platforms. The Microsoft Java VM is included in most versions of Windows and Internet Explorer. In some versions ..."], "related_cwes": ["CWE-693"]}, "238": {"name": "DEPRECATED: Using URL/codebase / G.A.C. (code source) to convince sandbox of privilege", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated as it did not appear to be a valid attack pattern."}, "239": {"name": "DEPRECATED: Subversion of Authorization Checks: Cache Filtering, Programmatic Security, etc.", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated as it did not contain any content and did not serve any useful purpose. Please refer to \"CAPEC-207: removing Important Client Functionality\" going forward."}, "24": {"name": "Filter Failure through Buffer Overflow", "abstraction": "Detailed", "status": "Draft", "description": "In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).", "likelihood": "High", "severity": "High", "prerequisites": ["Ability to control the length of data passed to an active filter."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey] The attacker surveys the target application, possibly as a valid and authenticated user"}, {"step": "2", "phase": "Experiment", "description": "[Attempt injections] Try to feed overly long data to the system. This can be done manually or a dynamic tool (black box) can be used to automate this. An attacker can also use a custom script for that..."}, {"step": "3", "phase": "Experiment", "description": "[Monitor responses] Watch for any indication of failure occurring. Carefully watch to see what happened when filter failure occurred. Did the data get in?"}, {"step": "4", "phase": "Exploit", "description": "[Abuse the system through filter failure] An attacker writes a script to consistently induce the filter failure."}], "examples": ["A filter is used by a web application to filter out characters that may allow the input to jump from the data plane to the control plane when data is used in a SQL statement (chaining this attack with the SQL injection attack). Leveraging a buffer overflow the attacker makes the filter fail insecure...", "Audit Truncation and Filters with Buffer Overflow. Sometimes very large transactions can be used to destroy a log file or cause partial logging failures. In this kind of attack, log processing code might be examining a transaction in real-time processing, but the oversized transaction causes a logic..."], "related_cwes": ["CWE-120", "CWE-119", "CWE-118", "CWE-74", "CWE-20", "CWE-680", "CWE-733", "CWE-697"]}, "240": {"name": "Resource Injection", "abstraction": "Meta", "status": "Stable", "description": "An adversary exploits weaknesses in input validation by manipulating resource identifiers enabling the unintended modification or specification of a resource.", "likelihood": "High", "severity": "High", "prerequisites": ["The target application allows the user to both specify the identifier used to access a system resource. Through this permission, the user gains the capability to perform actions on that resource (e.g...."], "related_cwes": ["CWE-99"]}, "241": {"name": "DEPRECATED: Code Injection", "abstraction": "Meta", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of the existing attack pattern \"CAPEC-242 : Code Injection\". Please refer to this other CAPEC going forward."}, "242": {"name": "Code Injection", "abstraction": "Meta", "status": "Stable", "description": "An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.", "likelihood": "High", "severity": "High", "prerequisites": ["The target software does not validate user-controlled input such that the execution of a process may be altered by sending code in through legitimate data channels, using no other mechanism."], "related_cwes": ["CWE-94"]}, "243": {"name": "XSS Targeting HTML Attributes", "abstraction": "Detailed", "status": "Draft", "description": "An adversary inserts commands to perform cross-site scripting (XSS) actions in HTML attributes. Many filters do not adequately sanitize attributes against the presence of potentially dangerous commands even if they adequately sanitize tags. For example, dangerous expressions could be inserted into a style attribute in an anchor tag, resulting in the execution of malicious code when the resulting page is rendered. If a victim is tricked into viewing the rendered page the attack proceeds like a no...", "severity": "Medium", "prerequisites": ["The target application must fail to adequately sanitize HTML attributes against the presence of dangerous commands."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser or an automated tool, an adversary follows all public links and actions on a web site. They record all the links, the forms, the r..."}, {"step": "2", "phase": "Experiment", "description": "[Probe identified potential entry points for XSS targeting HTML attributes] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and injects various malicious expressio..."}, {"step": "3", "phase": "Experiment", "description": "[Craft malicious XSS URL] Once the adversary has determined which parameters are vulnerable to XSS, they will craft a malicious URL containing the XSS exploit. The adversary can have many goals, from ..."}, {"step": "4", "phase": "Exploit", "description": "[Get victim to click URL] In order for the attack to be successful, the victim needs to access the malicious URL."}], "related_cwes": ["CWE-83"]}, "244": {"name": "XSS Targeting URI Placeholders", "abstraction": "Detailed", "status": "Draft", "description": "An attack of this type exploits the ability of most browsers to interpret \"data\", \"javascript\" or other URI schemes as client-side executable content placeholders. This attack consists of passing a malicious URI in an anchor tag HREF attribute or any other similar attributes in other HTML tags. Such malicious URI contains, for example, a base64 encoded HTML content with an embedded cross-site scripting payload. The attack is executed when the browser interprets the malicious content i.e., for ex...", "likelihood": "High", "severity": "High", "prerequisites": ["Target client software must allow scripting such as JavaScript and allows executable content delivered using a data URI scheme."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser or an automated tool, an adversary follows all public links and actions on a web site. They record all the links, the forms, the r..."}, {"step": "2", "phase": "Experiment", "description": "[Probe identified potential entry points for reflected XSS vulnerability] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and injects various payloads formatted as..."}, {"step": "3", "phase": "Experiment", "description": "[Craft malicious XSS URL] Once the adversary has determined which parameters are vulnerable to XSS, they will craft a malicious URL containing the XSS exploit. The adversary can have many goals, from ..."}, {"step": "4", "phase": "Exploit", "description": "[Get victim to click URL] In order for the attack to be successful, the victim needs to access the malicious URL."}], "related_cwes": ["CWE-83"]}, "245": {"name": "XSS Using Doubled Characters", "abstraction": "Detailed", "status": "Draft", "description": "The adversary bypasses input validation by using doubled characters in order to perform a cross-site scripting attack. Some filters fail to recognize dangerous sequences if they are preceded by repeated characters. For example, by doubling the < before a script command, (<<script or %3C%3script using URI encoding) the filters of some web applications may fail to recognize the presence of a script tag. If the targeted server is vulnerable to this type of bypass, the adversary can create a crafted...", "severity": "Medium", "prerequisites": ["The targeted web application does not fully normalize input before checking for prohibited syntax. In particular, it must fail to recognize prohibited methods preceded by certain sequences of repeated..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser or an automated tool, an adversary follows all public links and actions on a web site. They record all the links, the forms, the r..."}, {"step": "2", "phase": "Experiment", "description": "[Probe identified potential entry points for XSS using double characters] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and injects various common script payload..."}, {"step": "3", "phase": "Experiment", "description": "[Craft malicious XSS URL] Once the adversary has determined which parameters are vulnerable to XSS, they will craft a malicious URL containing the XSS exploit. The adversary can have many goals, from ..."}, {"step": "4", "phase": "Exploit", "description": "[Get victim to click URL] In order for the attack to be successful, the victim needs to access the malicious URL."}], "related_cwes": ["CWE-85"]}, "246": {"name": "DEPRECATED: XSS Using Flash", "abstraction": "Detailed", "status": "Deprecated", "description": "This pattern has been deprecated as it is covered by a chaining relationship between CAPEC-174: Flash Parameter Injection and CAPEC-591: Stored XSS. Please refer to these CAPECs going forward."}, "247": {"name": "XSS Using Invalid Characters", "abstraction": "Detailed", "status": "Draft", "description": "An adversary inserts invalid characters in identifiers to bypass application filtering of input. Filters may not scan beyond invalid characters but during later stages of processing content that follows these invalid characters may still be processed. This allows the adversary to sneak prohibited commands past filters and perform normally prohibited operations. Invalid characters may include null, carriage return, line feed or tab in an identifier. Successful bypassing of the filter can result i...", "severity": "Medium", "prerequisites": ["The target must fail to remove invalid characters from input and fail to adequately scan beyond these characters."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser or an automated tool, an adversary follows all public links and actions on a web site. They record all the links, the forms, the r..."}, {"step": "2", "phase": "Experiment", "description": "[Probe identified potential entry points for XSS vulnerabilities using invalid characters] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and injects various comm..."}, {"step": "3", "phase": "Experiment", "description": "[Craft malicious XSS URL] Once the adversary has determined which parameters are vulnerable to XSS, they will craft a malicious URL containing the XSS exploit. The adversary can have many goals, from ..."}, {"step": "4", "phase": "Exploit", "description": "[Get victim to click URL] In order for the attack to be successful, the victim needs to access the malicious URL."}], "related_cwes": ["CWE-86"]}, "248": {"name": "Command Injection", "abstraction": "Meta", "status": "Stable", "description": "An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitatio...", "likelihood": "Medium", "severity": "High", "prerequisites": ["The target application must accept input from the user and then use this input in the construction of commands to be executed. In virtually all cases, this is some form of string input that is concate..."], "related_cwes": ["CWE-77"]}, "249": {"name": "DEPRECATED: Linux Terminal Injection", "abstraction": "Standard", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is covered by \"CAPEC-40 : Manipulating Writeable Terminal Devices\". Please refer to this CAPEC going forward."}, "25": {"name": "Forced Deadlock", "abstraction": "Meta", "status": "Stable", "description": "The adversary triggers and exploits a deadlock condition in the target software to cause a denial of service. A deadlock can occur when two or more competing actions are waiting for each other to finish, and thus neither ever does. Deadlock conditions can be difficult to detect.", "likelihood": "Low", "severity": "High", "prerequisites": ["The target host has a deadlock condition. There are four conditions for a deadlock to occur, known as the Coffman conditions. [REF-101]", "The target host exposes an API to the user."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "The adversary initiates an exploratory phase to get familiar with the system."}, {"step": "2", "phase": "Explore", "description": "The adversary triggers a first action (such as holding a resource) and initiates a second action which will wait for the first one to finish."}, {"step": "3", "phase": "Explore", "description": "If the target program has a deadlock condition, the program waits indefinitely resulting in a denial of service."}], "examples": ["An example of a deadlock which may occur in database products is the following. Client applications using the database may require exclusive access to a table, and in order to gain exclusive access they ask for a lock. If one client application holds a lock on a table and attempts to obtain the lock..."], "related_cwes": ["CWE-412", "CWE-567", "CWE-662", "CWE-667", "CWE-833", "CWE-1322"]}, "250": {"name": "XML Injection", "abstraction": "Standard", "status": "Draft", "description": "An attacker utilizes crafted XML user-controllable input to probe, attack, and inject data into the XML database, using techniques similar to SQL injection. The user-controllable input can allow for unauthorized viewing of data, bypassing authentication or the front-end application for direct XML database access, and possibly altering database information.", "likelihood": "High", "prerequisites": ["XML queries used to process user input and retrieve information stored in XML documents", "User-controllable input not properly sanitized"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the Target] Using a browser or an automated tool, an adversary records all instances of user-controllable input used to contruct XML queries"}, {"step": "2", "phase": "Experiment", "description": "[Determine the Structure of Queries] Using manual or automated means, test inputs found for XML weaknesses."}, {"step": "3", "phase": "Exploit", "description": "[Inject Content into XML Queries] Craft malicious content containing XML expressions that is not validated by the application and is executed as part of the XML queries."}], "examples": ["Consider an application that uses an XML database to authenticate its users. The application retrieves the user name and password from a request and forms an XPath expression to query the database. An attacker can successfully bypass authentication and login without valid credentials through XPath I..."], "related_cwes": ["CWE-91", "CWE-74", "CWE-20", "CWE-707"]}, "251": {"name": "Local Code Inclusion", "abstraction": "Standard", "status": "Stable", "description": "The attacker forces an application to load arbitrary code files from the local machine. The attacker could use this to try to load old versions of library files that have known vulnerabilities, to load files that the attacker placed on the local machine during a prior attack, or to otherwise change the functionality of the targeted application in unexpected ways.", "severity": "Medium", "prerequisites": ["The targeted application must have a bug that allows an adversary to control which code file is loaded at some juncture.", "Some variants of this attack may require that old versions of some code files be present and in predictable locations."], "related_cwes": ["CWE-829"]}, "252": {"name": "PHP Local File Inclusion", "abstraction": "Detailed", "status": "Draft", "description": "The attacker loads and executes an arbitrary local PHP file on a target machine. The attacker could use this to try to load old versions of PHP files that have known vulnerabilities, to load PHP files that the attacker placed on the local machine during a prior attack, or to otherwise change the functionality of the targeted application in unexpected ways.", "severity": "Medium", "prerequisites": ["The targeted PHP application must have a bug that allows an attacker to control which code file is loaded at some juncture."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey application] Using a browser or an automated tool, an adversary follows all public links on a web site. They record all the links they find. The adversary is looking for URLs that show PHP fil..."}, {"step": "2", "phase": "Experiment", "description": "[Attempt variations on input parameters] Once the adversary finds a vulnerable URL that takes file input, they attempt a variety of path traversal techniques to attempt to get the application to displ..."}, {"step": "3", "phase": "Exploit", "description": "[Include desired local file] Once the adversary has determined which techniques of path traversal successfully work with the vulnerable PHP application, they will target a specific local file to inclu..."}], "related_cwes": ["CWE-829"]}, "253": {"name": "Remote Code Inclusion", "abstraction": "Standard", "status": "Draft", "description": "The attacker forces an application to load arbitrary code files from a remote location. The attacker could use this to try to load old versions of library files that have known vulnerabilities, to load malicious files that the attacker placed on the remote machine, or to otherwise change the functionality of the targeted application in unexpected ways.", "prerequisites": ["Target application server must allow remote files to be included.The malicious file must be placed on the remote machine previously."], "related_cwes": ["CWE-829"]}, "254": {"name": "DEPRECATED: DTD Injection in a SOAP Message", "abstraction": "Detailed", "status": "Deprecated", "description": "This pattern has been deprecated as it was determined to be an unnecessary layer of abstraction. Please refer to the pattern CAPEC-228 : DTD Injection going forward."}, "256": {"name": "SOAP Array Overflow", "abstraction": "Detailed", "status": "Draft", "description": "An attacker sends a SOAP request with an array whose actual length exceeds the length indicated in the request. If the server processing the transmission naively trusts the specified size, then an attacker can intentionally understate the size of the array, possibly resulting in a buffer overflow if the server attempts to read the entire data set into the memory it allocated for a smaller array.", "severity": "High", "prerequisites": ["The targeted SOAP server must trust that the array size as stated in messages it receives is correct, but read through the entire content of the message regardless of the stated size of the array."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target application] The adversary identifies a target application to perform the buffer overflow on. In this attack, adversaries look for applications that utilize SOAP as a communication me..."}, {"step": "2", "phase": "Experiment", "description": "[Find injection vector] The adversary identifies an injection vector to deliver the excessive content to the targeted application's buffer."}, {"step": "3", "phase": "Experiment", "description": "[Craft overflow content] The adversary crafts the content to be injected. If the intent is to simply cause the software to crash, the content need only consist of an excessive quantity of random data...."}, {"step": "4", "phase": "Exploit", "description": "[Overflow the buffer] Using the injection vector, the adversary sends the crafted SOAP message to the program, overflowing the buffer."}], "related_cwes": ["CWE-805"]}, "257": {"name": "DEPRECATED: Abuse of Transaction Data Structure", "abstraction": "Meta", "status": "Deprecated", "description": "This attack pattern has been deprecated as it was deemed not to be a legitimate attack pattern."}, "258": {"name": "DEPRECATED: Passively Sniffing and Capturing Application Code Bound for an Authorized Client During Dynamic Update", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of the existing attack pattern \"CAPEC-65 : Sniff Application Code\". Please refer to this other CAPEC going forward."}, "259": {"name": "DEPRECATED: Passively Sniffing and Capturing Application Code Bound for an Authorized Client During Patching", "abstraction": "Standard", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of the existing attack pattern \"CAPEC-65 : Sniff Application Code\". Please refer to this other CAPEC going forward."}, "26": {"name": "Leveraging Race Conditions", "abstraction": "Meta", "status": "Stable", "description": "The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by \"running the race\", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their ve...", "likelihood": "High", "severity": "High", "prerequisites": ["A resource is accessed/modified concurrently by multiple processes such that a race condition exists.", "The adversary has the ability to modify the resource."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "The adversary explores to gauge what level of access they have."}, {"step": "2", "phase": "Experiment", "description": "The adversary gains access to a resource on the target host. The adversary modifies the targeted resource. The resource's value is used to determine the next normal execution action."}, {"step": "3", "phase": "Exploit", "description": "The resource is modified/checked concurrently by multiple processes. By using one of the processes, the adversary is able to modify the value just before it is consumed by a different process. A race ..."}], "examples": ["The Net Direct client for Linux before 6.0.5 in Nortel Application Switch 2424, VPN 3050 and 3070, and SSL VPN Module 1000 extracts and executes files with insecure permissions, which allows local users to exploit a race condition to replace a world-writable file in /tmp/NetClient and cause another ..."], "related_cwes": ["CWE-368", "CWE-363", "CWE-366", "CWE-370", "CWE-362", "CWE-662", "CWE-689", "CWE-667", "CWE-665", "CWE-1223", "CWE-1254", "CWE-1298"]}, "260": {"name": "DEPRECATED: Passively Sniffing and Capturing Application Code Bound for an Authorized Client During Initial Distribution", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of the existing attack pattern \"CAPEC-65 : Sniff Application Code\". Please refer to this other CAPEC going forward."}, "261": {"name": "Fuzzing for garnering other adjacent user/sensitive data", "abstraction": "Detailed", "status": "Draft", "description": "An adversary who is authorized to send queries to a target sends variants of expected queries in the hope that these modified queries might return information (directly or indirectly through error logs) beyond what the expected set of queries should provide.", "severity": "Medium", "prerequisites": ["The server must assume that the queries it receives follow specific templates and/or have fields or attributes that follow specific procedures. The server must process queries that it receives without..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Observe communication and inputs] The fuzzing adversary observes the target system looking for inputs and communications between modules, subsystems, or systems."}, {"step": "2", "phase": "Experiment", "description": "[Generate fuzzed inputs] Given a fuzzing tool, a target input or protocol, and limits on time, complexity, and input variety, generate a list of inputs to try. Although fuzzing is random, it is not ex..."}, {"step": "3", "phase": "Experiment", "description": "[Observe the outcome] Observe the outputs to the inputs fed into the system by fuzzers and see if there are any log or error messages that either provide user/sensitive data or give information about ..."}, {"step": "4", "phase": "Exploit", "description": "[Craft exploit payloads] If the logs did not reveal any user/sensitive data, an adversary will attempt to make the fuzzing inputs form to an expected template"}], "related_cwes": ["CWE-20"]}, "263": {"name": "Force Use of Corrupted Files", "abstraction": "Detailed", "status": "Draft", "description": "This describes an attack where an application is forced to use a file that an attacker has corrupted. The result is often a denial of service caused by the application being unable to process the corrupted file, but other results, including the disabling of filters or access controls (if the application fails in an unsafe way rather than failing by locking down) or buffer overflows are possible.", "severity": "Medium", "prerequisites": ["The targeted application must utilize a configuration file that an attacker is able to corrupt. In some cases, the attacker must be able to force the (re-)reading of the corrupted file if the file is ...", "The severity of the attack hinges on how the application responds to the corrupted file. If the application detects the corruption and locks down, this may result in the denial of services provided by..."], "related_cwes": ["CWE-829"]}, "264": {"name": "DEPRECATED: Environment Variable Manipulation", "abstraction": "Meta", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of the existing attack pattern \"CAPEC-13 : Subverting Environment Variable Values\". Please refer to this other CAPEC going forward."}, "265": {"name": "DEPRECATED: Global variable manipulation", "abstraction": "Meta", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of the existing attack pattern \"CAPEC-77 : Manipulating User-Controlled Variables\". Please refer to this other CAPEC going forward."}, "266": {"name": "DEPRECATED: Manipulate Canonicalization", "abstraction": "Meta", "status": "Deprecated", "description": "This attack pattern has been deprecated."}, "267": {"name": "Leverage Alternate Encoding", "abstraction": "Standard", "status": "Draft", "description": "An adversary leverages the possibility to encode potentially harmful input or content used by applications such that the applications are ineffective at validating this encoding standard.", "likelihood": "High", "severity": "High", "prerequisites": ["The application's decoder accepts and interprets encoded characters. Data canonicalization, input filtering and validating is not done properly leaving the door open to harmful characters for the targ..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application."}, {"step": "2", "phase": "Experiment", "description": "[Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and injects various payloads using a variety of different types of e..."}], "examples": ["Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified \"encoding strings,\" which allows remote adversaries to bypass the Same Origin Policy and obtain sensitive information via a crafted web site, aka \"Post Encoding Information Disclosure Vulnerability.\" Related V...", "Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses."], "related_cwes": ["CWE-173", "CWE-172", "CWE-180", "CWE-181", "CWE-73", "CWE-74", "CWE-20", "CWE-697", "CWE-692"]}, "268": {"name": "Audit Log Manipulation", "abstraction": "Standard", "status": "Draft", "description": "The attacker injects, manipulates, deletes, or forges malicious log entries into the log file, in an attempt to mislead an audit of the log file or cover tracks of an attack. Due to either insufficient access controls of the log files or the logging mechanism, the attacker is able to perform such actions.", "prerequisites": ["The target host is logging the action and data of the user.", "The target host insufficiently protects access to the logs or logging mechanisms."], "related_cwes": ["CWE-117"]}, "269": {"name": "DEPRECATED: Registry Manipulation", "abstraction": "Meta", "status": "Deprecated", "description": "This pattern has been deprecated as it was determined to be a duplicate of another pattern. Please refer to the pattern CAPEC-203 : Manipulate Application Registry Values going forward."}, "27": {"name": "Leveraging Race Conditions via Symbolic Links", "abstraction": "Detailed", "status": "Draft", "description": "This attack leverages the use of symbolic links (Symlinks) in order to write to sensitive files. An attacker can create a Symlink link to a target file not otherwise accessible to them. When the privileged program tries to create a temporary file with the same name as the Symlink link, it will actually write to the target file pointed to by the attackers' Symlink link. If the attacker can insert malicious content in the temporary file they will be writing to the sensitive file by using the Symli...", "likelihood": "Medium", "severity": "High", "prerequisites": ["The attacker is able to create Symlink links on the target host.", "Tainted data from the attacker is used and copied to temporary files.", "The target host does insecure temporary file creation."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Verify that target host's platform supports symbolic links.] This attack pattern is only applicable on platforms that support symbolic links."}, {"step": "2", "phase": "Explore", "description": "[Examine application's file I/O behavior] Analyze the application's file I/O behavior to determine where it stores files, as well as the operations it performs to read/write files."}, {"step": "3", "phase": "Experiment", "description": "[Verify ability to write to filesystem] The attacker verifies ability to write to the target host's file system."}, {"step": "4", "phase": "Exploit", "description": "[Replace file with a symlink to a sensitive system file.] Between the time that the application checks to see if a file exists (or if the user has access to it) and the time the application actually o..."}], "examples": ["GNU \"ed\" utility (before 0.3) allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function. See also: CVE-2006-6939", "OpenmosixCollector and OpenMosixView in OpenMosixView 1.5 allow local users to overwrite or delete arbitrary files via a symlink attack on (1) temporary files in the openmosixcollector directory or (2) nodes.tmp. See also: CVE-2005-0894", "Setuid product allows file reading by replacing a file being edited with a symlink to the targeted file, leaking the result in error messages when parsing fails. See also: CVE-2000-0972"], "related_cwes": ["CWE-367", "CWE-61", "CWE-662", "CWE-689", "CWE-667"]}, "270": {"name": "Modification of Registry Run Keys", "abstraction": "Detailed", "status": "Stable", "description": "An adversary adds a new entry to the \"run keys\" in the Windows registry so that an application of their choosing is executed when a user logs in. In this way, the adversary can get their executable to operate and run on the target system with the authorized user's level of permissions. This attack is a good way for an adversary to run persistent spyware on a user's machine, such as a keylogger.", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The adversary must have gained access to the target system via physical or logical means in order to carry out this attack."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine target system] The adversary must first determine the system they wish to target. This attack only works on Windows."}, {"step": "2", "phase": "Experiment", "description": "[Gain access to the system] The adversary needs to gain access to the system in some way so that they can modify the Windows registry."}, {"step": "3", "phase": "Exploit", "description": "[Modify Windows registry] The adversary will modify the Windows registry by adding a new entry to the \"run keys\" referencing a desired program. This program will be run whenever the user logs in."}], "examples": ["An adversary can place a malicious executable (RAT) on the target system and then configure it to automatically run when the user logs in to maintain persistence on the target system.", "Through the modification of registry \"run keys\" the adversary can masquerade a malicious executable as a legitimate program."], "related_cwes": ["CWE-15"]}, "271": {"name": "Schema Poisoning", "abstraction": "Standard", "status": "Draft", "description": "An adversary corrupts or modifies the content of a schema for the purpose of undermining the security of the target. Schemas provide the structure and content definitions for resources used by an application. By replacing or modifying a schema, the adversary can affect how the application handles or interprets a resource, often leading to possible denial of service, entering into an unexpected state, or recording incomplete data.", "likelihood": "Low", "severity": "High", "prerequisites": ["Some level of access to modify the target schema.", "The schema used by the target application must be improperly secured against unauthorized modification and manipulation."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find target application and schema] The adversary first finds the application that they want to target. This application must use schemas in some way, so the adversary also needs to confirm that sche..."}, {"step": "2", "phase": "Experiment", "description": "[Gain access to schema] The adversary gains access to the schema so that they can modify the contents."}, {"step": "3", "phase": "Exploit", "description": "[Poison schema] Once the adversary gains access to the schema, they will alter it to achieve a desired effect. Locally, they can just modify the file. For remote schemas, the adversary will alter the ..."}], "related_cwes": ["CWE-15"]}, "272": {"name": "Protocol Manipulation", "abstraction": "Meta", "status": "Draft", "description": "An adversary subverts a communications protocol to perform an attack. This type of attack can allow an adversary to impersonate others, discover sensitive information, control the outcome of a session, or perform other attacks. This type of attack targets invalid assumptions that may be inherent in implementers of the protocol, incorrect implementations of the protocol, or vulnerabilities in the protocol itself.", "severity": "Medium", "prerequisites": ["The protocol or implementations thereof must contain bugs that an adversary can exploit."]}, "273": {"name": "HTTP Response Smuggling", "abstraction": "Detailed", "status": "Stable", "likelihood": "Medium", "severity": "High", "prerequisites": ["A vulnerable or compromised server or domain/site capable of allowing adversary to insert/inject malicious content that will appear in the server's response to target HTTP agents (e.g., proxies and us...", "Differences in the way the two HTTP agents parse and interpret HTTP responses and its headers.", "HTTP agents running on HTTP/1.1 that allow for Keep Alive mode, Pipelined queries, and Chunked queries and responses."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey network to identify target] The adversary performs network reconnaissance by monitoring relevant traffic to identify the network path and parsing of the HTTP messages with the goal of identify..."}, {"step": "1", "phase": "Experiment", "description": "[Identify vulnerabilities in targeted HTTP infrastructure and technologies] The adversary sends a variety of benign/ambiguous HTTP requests to observe responses from HTTP infrastructure to intended ta..."}, {"step": "2", "phase": "Experiment", "description": "[Cause differential HTTP responses by experimenting with identified HTTP Response vulnerabilities] The adversary sends maliciously crafted HTTP request to back-end HTTP infrastructure to inject advers..."}, {"step": "1", "phase": "Exploit", "description": "[Perform HTTP Response Smuggling attack] Using knowledge discovered in the experiment section above, smuggle a message to cause one of the consequences."}], "related_cwes": ["CWE-74", "CWE-436", "CWE-444"]}, "274": {"name": "HTTP Verb Tampering", "abstraction": "Detailed", "status": "Draft", "description": "An attacker modifies the HTTP Verb (e.g. GET, PUT, TRACE, etc.) in order to bypass access restrictions. Some web environments allow administrators to restrict access based on the HTTP Verb used with requests. However, attackers can often provide a different HTTP Verb, or even provide a random string as a verb in order to bypass these protections. This allows the attacker to access data that should otherwise be protected.", "severity": "Medium", "prerequisites": ["The targeted system must attempt to filter access based on the HTTP verb used in requests."], "related_cwes": ["CWE-302", "CWE-654"]}, "275": {"name": "DNS Rebinding", "abstraction": "Detailed", "status": "Draft", "description": "An adversary serves content whose IP address is resolved by a DNS server that the adversary controls. After initial contact by a web browser (or similar client), the adversary changes the IP address to which its name resolves, to an address within the target organization that is not publicly accessible. This allows the web browser to examine this internal address on behalf of the adversary.", "likelihood": "High", "severity": "Very High", "prerequisites": ["The target browser must access content server from the adversary controlled DNS name. Web advertisements are often used for this purpose. The target browser must honor the TTL value returned by the ad..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify potential DNS rebinding targets] An adversary publishes content on their own server with their own name and DNS server. Attract HTTP traffic and explore rebinding vulnerabilities in browsers..."}, {"step": "2", "phase": "Experiment", "description": "[Establish initial target access to adversary DNS] The first time the target accesses the adversary's content, the adversary's name must be resolved to an IP address. The adversary's DNS server perfor..."}, {"step": "3", "phase": "Experiment", "description": "[Rebind DNS resolution to target address] The target makes a subsequent request to the adversary's content and the adversary's DNS server must again be queried, but this time the DNS server returns an..."}, {"step": "4", "phase": "Experiment", "description": "[Determine exploitability of DNS rebinding access to target address] The adversary can then use scripts in the content the target retrieved from the adversary in the original message to exfiltrate dat..."}, {"step": "5", "phase": "Exploit", "description": "[Access & exfiltrate data within the victim's security zone] The adversary can then use scripts in the content the target retrieved from the adversary in the original message to exfiltrate data from t..."}], "examples": ["The adversary registers a domain name, such as www.evil.com with IP address 1.3.5.7, delegates it to their own DNS server (1.3.5.2), and uses phishing links or emails to get HTTP traffic. Instead of sending a normal TTL record, the DNS server sends a very short TTL record (for example, 1 second), pr..."], "related_cwes": ["CWE-350"]}, "276": {"name": "Inter-component Protocol Manipulation", "abstraction": "Standard", "status": "Draft", "description": "Inter-component protocols are used to communicate between different software and hardware modules within a single computer. Common examples are: interrupt signals and data pipes. Subverting the protocol can allow an adversary to impersonate others, discover sensitive information, control the outcome of a session, or perform other attacks. This type of attack targets invalid assumptions that may be inherent in implementers of the protocol, incorrect implementations of the protocol, or vulnerabili...", "related_cwes": ["CWE-707"]}, "277": {"name": "Data Interchange Protocol Manipulation", "abstraction": "Standard", "status": "Draft", "description": "Data Interchange Protocols are used to transmit structured data between entities. These protocols are often specific to a particular domain (B2B: purchase orders, invoices, transport logistics and waybills, medical records). They are often, but not always, XML-based. Subverting the protocol can allow an adversary to impersonate others, discover sensitive information, control the outcome of a session, or perform other attacks. This type of attack targets invalid assumptions that may be inherent i...", "related_cwes": ["CWE-707"]}, "278": {"name": "Web Services Protocol Manipulation", "abstraction": "Standard", "status": "Draft", "description": "An adversary manipulates a web service related protocol to cause a web application or service to react differently than intended. This can either be performed through the manipulation of call parameters to include unexpected values, or by changing the called function to one that should normally be restricted or limited. By leveraging this pattern of attack, the adversary is able to gain access to data or resources normally restricted, or to cause the application or service to crash.", "prerequisites": ["The targeted application or service must rely on web service protocols in such a way that malicious manipulation of them can alter functionality."], "related_cwes": ["CWE-707"]}, "279": {"name": "SOAP Manipulation", "abstraction": "Detailed", "status": "Draft", "description": "Simple Object Access Protocol (SOAP) is used as a communication protocol between a client and server to invoke web services on the server. It is an XML-based protocol, and therefore suffers from many of the same shortcomings as other XML-based protocols. Adversaries can make use of these shortcomings and manipulate the content of SOAP paramters, leading to undesirable behavior on the server and allowing the adversary to carry out a number of further attacks.", "likelihood": "Medium", "severity": "High", "prerequisites": ["An application uses SOAP-based web service api.", "An application does not perform sufficient input validation to ensure that user-controllable data is safe for an XML parser.", "The targeted server either fails to verify that data in SOAP messages conforms to the appropriate XML schema, or it fails to correctly handle the complete range of data allowed by the schema."], "execution_flow": [{"step": "1", "phase": "Exploit", "description": "[Find target application] The adversary needs to identify an application that uses SOAP as a communication protocol."}, {"step": "2", "phase": "Experiment", "description": "[Detect Incorrect SOAP Parameter Handling] The adversary tampers with the SOAP message parameters and looks for indications that the tampering caused a change in behavior of the targeted application."}, {"step": "3", "phase": "Exploit", "description": "[Manipulate SOAP parameters] The adversary manipulates SOAP parameters in a way that causes undesirable behavior for the server. This can result in denial of service, information disclosure, arbitrary..."}], "related_cwes": ["CWE-707"]}, "28": {"name": "Fuzzing", "abstraction": "Meta", "status": "Draft", "description": "In this attack pattern, the adversary leverages fuzzing to try to identify weaknesses in the system. Fuzzing is a software security and functionality testing method that feeds randomly constructed input to the system and looks for an indication that a failure in response to that input has occurred. Fuzzing treats the system as a black box and is totally free from any preconceptions or assumptions about the system. Fuzzing can help an attacker discover certain assumptions made about user input in...", "likelihood": "High", "severity": "Medium", "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Observe communication and inputs] The fuzzing attacker observes the target system looking for inputs and communications between modules, subsystems, or systems."}, {"step": "2", "phase": "Experiment", "description": "[Generate fuzzed inputs] Given a fuzzing tool, a target input or protocol, and limits on time, complexity, and input variety, generate a list of inputs to try. Although fuzzing is random, it is not ex..."}, {"step": "3", "phase": "Experiment", "description": "[Observe the outcome] Observe the outputs to the inputs fed into the system by fuzzers and see if anything interesting happens. If failure occurs, determine why that happened. Figure out the underlyin..."}, {"step": "4", "phase": "Exploit", "description": "[Craft exploit payloads] Put specially crafted input into the system that leverages the weakness identified through fuzzing and allows to achieve the goals of the attacker. Fuzzers often reveal ways t..."}], "examples": ["A fuzz test reveals that when data length for a particular field exceeds certain length, the input validation filter fails and lets the user data in unfiltered. This provides an attacker with an injection vector to deliver the malicious payload into the system."], "related_cwes": ["CWE-74", "CWE-20"]}, "280": {"name": "DEPRECATED: SOAP Parameter Tampering", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated as its contents have been included in CAPEC-279 : SOAP Manipulation. Please refer to this other pattern going forward."}, "285": {"name": "ICMP Echo Request Ping", "abstraction": "Detailed", "status": "Stable", "description": "An adversary sends out an ICMP Type 8 Echo Request, commonly known as a 'Ping', in order to determine if a target system is responsive. If the request is not blocked by a firewall or ACL, the target host will respond with an ICMP Type 0 Echo Reply datagram. This type of exchange is usually referred to as a 'Ping' due to the Ping utility present in almost all operating systems. Ping, as commonly implemented, allows a user to test for alive hosts, measure round-trip time, and measure the percentag...", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The ability to send an ICMP type 8 query (Echo Request) to a remote target and receive an ICMP type 0 message (ICMP Echo Reply) in response. Any firewalls or access control lists between the sender an..."], "related_cwes": ["CWE-200"]}, "287": {"name": "TCP SYN Scan", "abstraction": "Detailed", "status": "Stable", "description": "An adversary uses a SYN scan to determine the status of ports on the remote target. SYN scanning is the most common type of port scanning that is used because of its many advantages and few drawbacks. As a result, novice attackers tend to overly rely on the SYN scan while performing system reconnaissance. As a scanning method, the primary advantages of SYN scanning are its universality and speed.", "severity": "Low", "prerequisites": ["This scan type is not possible with some operating systems (Windows XP SP 2). On Linux and Unix systems it requires root privileges to use raw sockets."], "execution_flow": [{"step": "1", "phase": "Experiment", "description": "An adversary sends SYN packets to ports they want to scan and checks the response without completing the TCP handshake."}, {"step": "2", "phase": "Experiment", "description": "An adversary uses the response from the target to determine the port's state. The adversary can determine the state of a port based on the following responses. When a SYN is sent to an open port and u..."}], "related_cwes": ["CWE-200"]}, "288": {"name": "DEPRECATED: ICMP Echo Request Ping", "abstraction": "Meta", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of the existing attack pattern \"CAPEC-285\". Please refer to this other CAPEC going forward.", "severity": "Low"}, "289": {"name": "DEPRECATED: Infrastructure-based footprinting", "abstraction": "Meta", "status": "Deprecated", "description": "This attack pattern has been deprecated as it was determined to be an unnecessary layer of abstraction. Please refer to the meta level pattern CAPEC-169 : going forward, or to any of its children patterns."}, "29": {"name": "Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions", "abstraction": "Standard", "status": "Draft", "description": "This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by \"running the race\", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to be...", "likelihood": "High", "severity": "High", "prerequisites": ["A resource is access/modified concurrently by multiple processes.", "The adversary is able to modify resource.", "A race condition exists while accessing a resource."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "The adversary explores to gauge what level of access they have."}, {"step": "2", "phase": "Experiment", "description": "The adversary confirms access to a resource on the target host. The adversary confirms ability to modify the targeted resource."}, {"step": "3", "phase": "Exploit", "description": "The adversary decides to leverage the race condition by \"running the race\", meaning that they would modify the resource between the first time the target program accesses the file and the time the tar..."}], "examples": ["The Net Direct client for Linux before 6.0.5 in Nortel Application Switch 2424, VPN 3050 and 3070, and SSL VPN Module 1000 extracts and executes files with insecure permissions, which allows local users to exploit a race condition to replace a world-writable file in /tmp/NetClient and cause another ..."], "related_cwes": ["CWE-367", "CWE-368", "CWE-366", "CWE-370", "CWE-362", "CWE-662", "CWE-691", "CWE-663", "CWE-665"]}, "290": {"name": "Enumerate Mail Exchange (MX) Records", "abstraction": "Detailed", "status": "Stable", "description": "An adversary enumerates the MX records for a given via a DNS query. This type of information gathering returns the names of mail servers on the network. Mail servers are often not exposed to the Internet but are located within the DMZ of a network protected by a firewall. A side effect of this configuration is that enumerating the MX records for an organization my reveal the IP address of the firewall or possibly other internal systems. Attackers often resort to MX record enumeration when a DNS ...", "severity": "Low", "prerequisites": ["The adversary requires access to a DNS server that will return the MX records for a network."], "related_cwes": ["CWE-200"]}, "291": {"name": "DNS Zone Transfers", "abstraction": "Detailed", "status": "Stable", "description": "An attacker exploits a DNS misconfiguration that permits a ZONE transfer. Some external DNS servers will return a list of IP address and valid hostnames. Under certain conditions, it may even be possible to obtain Zone data about the organization's internal network. When successful the attacker learns valuable information about the topology of the target organization, including information about particular servers, their role within the IT structure, and possibly information about the operating ...", "severity": "Low", "prerequisites": ["Access to a DNS server that allows Zone transfers."], "related_cwes": ["CWE-200"]}, "292": {"name": "Host Discovery", "abstraction": "Standard", "status": "Stable", "description": "An adversary sends a probe to an IP address to determine if the host is alive. Host discovery is one of the earliest phases of network reconnaissance. The adversary usually starts with a range of IP addresses belonging to a target network and uses various methods to determine if a host is present at that IP address. Host discovery is usually referred to as 'Ping' scanning using a sonar analogy. The goal is to send a packet through to the IP address and solicit a response from the host. As such, ...", "severity": "Low", "prerequisites": ["The adversary requires logical access to the target network in order to carry out host discovery."], "related_cwes": ["CWE-200"]}, "293": {"name": "Traceroute Route Enumeration", "abstraction": "Detailed", "status": "Stable", "description": "An adversary uses a traceroute utility to map out the route which data flows through the network in route to a target destination. Tracerouting can allow the adversary to construct a working topology of systems and routers by listing the systems through which data passes through on their way to the targeted machine. This attack can return varied results depending upon the type of traceroute that is performed. Traceroute works by sending packets to a target while incrementing the Time-to-Live fie...", "severity": "Low", "prerequisites": ["A network capable of routing the attackers' packets to the destination network."], "related_cwes": ["CWE-200"]}, "294": {"name": "ICMP Address Mask Request", "abstraction": "Detailed", "status": "Stable", "description": "An adversary sends an ICMP Type 17 Address Mask Request to gather information about a target's networking configuration. ICMP Address Mask Requests are defined by RFC-950, \"Internet Standard Subnetting Procedure.\" An Address Mask Request is an ICMP type 17 message that triggers a remote system to respond with a list of its related subnets, as well as its default gateway and broadcast address via an ICMP type 18 Address Mask Reply datagram. Gathering this type of information helps the adversary p...", "severity": "Low", "prerequisites": ["The ability to send an ICMP type 17 query (Address Mask Request) to a remote target and receive an ICMP type 18 message (ICMP Address Mask Reply) in response. Generally, modern operating systems will ..."], "related_cwes": ["CWE-200"]}, "295": {"name": "Timestamp Request", "abstraction": "Detailed", "status": "Stable", "description": "This pattern of attack leverages standard requests to learn the exact time associated with a target system. An adversary may be able to use the timestamp returned from the target to attack time-based security algorithms, such as random number generators, or time-based authentication mechanisms.", "severity": "Low", "prerequisites": ["The ability to send a timestamp request to a remote target and receive a response."], "examples": ["An adversary sends an ICMP type 13 Timestamp Request to determine the time as recorded by a remote target. Timestamp Replies, ICMP Type 14, usually return a value in Greenwich Mean Time. An adversary can attempt to use an ICMP Timestamp requests to 'ping' a remote system to see if is alive. Addition...", "An adversary may gather the system time or time zone from a local or remote system. This information may be gathered in a number of ways, such as with Net on Windows by performing net time \\\\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the c..."], "related_cwes": ["CWE-200"]}, "296": {"name": "ICMP Information Request", "abstraction": "Detailed", "status": "Stable", "description": "An adversary sends an ICMP Information Request to a host to determine if it will respond to this deprecated mechanism. ICMP Information Requests are a deprecated message type. Information Requests were originally used for diskless machines to automatically obtain their network configuration, but this message type has been superseded by more robust protocol implementations like DHCP.", "severity": "Low", "prerequisites": ["The ability to send an ICMP Type 15 Information Request and receive an ICMP Type 16 Information Reply in response."], "related_cwes": ["CWE-200"]}, "297": {"name": "TCP ACK Ping", "abstraction": "Detailed", "status": "Stable", "description": "An adversary sends a TCP segment with the ACK flag set to a remote host for the purpose of determining if the host is alive. This is one of several TCP 'ping' types. The RFC 793 expected behavior for a service is to respond with a RST 'reset' packet to any unsolicited ACK segment that is not part of an existing connection. So by sending an ACK segment to a port, the adversary can identify that the host is alive by looking for a RST packet. Typically, a remote server will respond with a RST regar...", "severity": "Low", "prerequisites": ["The ability to send an ACK packet to a remote host and identify the response. Creating the ACK packet without building a full connection requires the use of raw sockets. As a result, it is not possibl...", "The target must employ a stateless firewall that lacks a rule set that rejects unsolicited ACK packets.", "The adversary requires the ability to craft custom TCP ACK segments for use during network reconnaissance. Sending an ACK ping requires the ability to access \"raw sockets\" in order to create the packe..."], "related_cwes": ["CWE-200"]}, "298": {"name": "UDP Ping", "abstraction": "Detailed", "status": "Stable", "description": "An adversary sends a UDP datagram to the remote host to determine if the host is alive. If a UDP datagram is sent to an open UDP port there is very often no response, so a typical strategy for using a UDP ping is to send the datagram to a random high port on the target. The goal is to solicit an 'ICMP port unreachable' message from the target, indicating that the host is alive. UDP pings are useful because some firewalls are not configured to block UDP datagrams sent to strange or typically unus...", "severity": "Low", "prerequisites": ["The adversary requires the ability to send a UDP datagram to a remote host and receive a response.", "The adversary requires the ability to craft custom UDP Packets for use during network reconnaissance.", "The target's firewall must not be configured to block egress ICMP messages."], "related_cwes": ["CWE-200"]}, "299": {"name": "TCP SYN Ping", "abstraction": "Detailed", "status": "Stable", "description": "An adversary uses TCP SYN packets as a means towards host discovery. Typical RFC 793 behavior specifies that when a TCP port is open, a host must respond to an incoming SYN \"synchronize\" packet by completing stage two of the 'three-way handshake' - by sending an SYN/ACK in response. When a port is closed, RFC 793 behavior is to respond with a RST \"reset\" packet. This behavior can be used to 'ping' a target to see if it is alive by sending a TCP SYN packet to a port and then looking for a RST or ...", "severity": "Low", "prerequisites": ["The ability to send a TCP SYN packet to a remote target. Depending upon the operating system, the ability to craft SYN packets may require elevated privileges."], "related_cwes": ["CWE-200"]}, "3": {"name": "Using Leading 'Ghost' Character Sequences to Bypass Input Filters", "abstraction": "Detailed", "status": "Draft", "description": "Some APIs will strip certain leading characters from a string of parameters. An adversary can intentionally introduce leading \"ghost\" characters (extra characters that don't affect the validity of the request at the API layer) that enable the input to pass the filters and therefore process the adversary's input. This occurs when the targeted API will accept input data in several syntactic forms and interpret it in the equivalent semantic way, while the filter does not take into account the full ...", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The targeted API must ignore the leading ghost characters that are used to get past the filters for the semantics to be the same."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application."}, {"step": "2", "phase": "Experiment", "description": "[Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and injects various leading 'Ghost' character sequences to determine..."}, {"step": "3", "phase": "Exploit", "description": "[Bypass input filtering] Using what the adversary learned about how the application filters input data, they craft specific input data that bypasses the filter. This can lead to directory traversal at..."}], "related_cwes": ["CWE-173", "CWE-41", "CWE-172", "CWE-179", "CWE-180", "CWE-181", "CWE-183", "CWE-184", "CWE-20", "CWE-74", "CWE-697", "CWE-707"]}, "30": {"name": "Hijacking a Privileged Thread of Execution", "abstraction": "Standard", "status": "Draft", "description": "An adversary hijacks a privileged thread of execution by injecting malicious code into a running process. By using a privleged thread to do their bidding, adversaries can evade process-based detection that would stop an attack that creates a new process. This can lead to an adversary gaining access to the process's memory and can also enable elevated privileges. The most common way to perform this attack is by suspending an existing thread and manipulating its memory.", "likelihood": "Low", "severity": "Very High", "prerequisites": ["The application in question employs a threaded model of execution with the threads operating at, or having the ability to switch to, a higher privilege level than normal users", "In order to feasibly execute this class of attacks, the adversary must have the ability to hijack a privileged thread. This ability includes, but is not limited to, modifying environment variables tha..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine target thread] The adversary determines the underlying system thread that is subject to user-control"}, {"step": "2", "phase": "Experiment", "description": "[Gain handle to thread] The adversary then gains a handle to a process thread."}, {"step": "3", "phase": "Experiment", "description": "[Alter process memory] Once the adversary has a handle to the target thread, they will suspend the thread and alter the memory using native OS calls."}, {"step": "4", "phase": "Exploit", "description": "[Resume thread execution] Once the process memory has been altered to execute malicious code, the thread is then resumed."}], "examples": ["Adversary targets an application written using Java's AWT, with the 1.2.2 era event model. In this circumstance, any AWTEvent originating in the underlying OS (such as a mouse click) would return a privileged thread (e.g., a system call). The adversary could choose to not return the AWT-generated th..."], "related_cwes": ["CWE-270"]}, "300": {"name": "Port Scanning", "abstraction": "Standard", "status": "Stable", "description": "An adversary uses a combination of techniques to determine the state of the ports on a remote target. Any service or application available for TCP or UDP networking will have a port open for communications over the network.", "severity": "Low", "prerequisites": ["The adversary requires logical access to the target's network in order to carry out this type of attack."], "related_cwes": ["CWE-200"]}, "301": {"name": "TCP Connect Scan", "abstraction": "Detailed", "status": "Stable", "description": "An adversary uses full TCP connection attempts to determine if a port is open on the target system. The scanning process involves completing a 'three-way handshake' with a remote port, and reports the port as closed if the full handshake cannot be established. An advantage of TCP connect scanning is that it works against any TCP/IP stack.", "severity": "Low", "prerequisites": ["The adversary requires logical access to the target network. The TCP connect Scan requires the ability to connect to an available port and complete a 'three-way-handshake' This scanning technique does..."], "execution_flow": [{"step": "1", "phase": "Experiment", "description": "An adversary attempts to initialize a TCP connection with with the target port."}, {"step": "2", "phase": "Experiment", "description": "An adversary uses the result of their TCP connection to determine the state of the target port. A successful connection indicates a port is open with a service listening on it while a failed connectio..."}], "related_cwes": ["CWE-200"]}, "302": {"name": "TCP FIN Scan", "abstraction": "Detailed", "status": "Stable", "description": "An adversary uses a TCP FIN scan to determine if ports are closed on the target machine. This scan type is accomplished by sending TCP segments with the FIN bit set in the packet header. The RFC 793 expected behavior is that any TCP segment with an out-of-state Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be handled with a RST in response. This behavior should allow the adversary to scan for closed ports by sending certain types of ...", "severity": "Low", "prerequisites": ["FIN scanning requires the use of raw sockets, and thus cannot be performed from some Windows systems (Windows XP SP 2, for example). On Unix and Linux, raw socket manipulations require root privileges..."], "execution_flow": [{"step": "1", "phase": "Experiment", "description": "An adversary sends TCP packets with the FIN flag but not associated with an existing connection to target ports."}, {"step": "2", "phase": "Experiment", "description": "An adversary uses the response from the target to determine the port's state. If no response is received the port is open. If a RST packet is received then the port is closed."}], "related_cwes": ["CWE-200"]}, "303": {"name": "TCP Xmas Scan", "abstraction": "Detailed", "status": "Stable", "description": "An adversary uses a TCP XMAS scan to determine if ports are closed on the target machine. This scan type is accomplished by sending TCP segments with all possible flags set in the packet header, generating packets that are illegal based on RFC 793. The RFC 793 expected behavior is that any TCP segment with an out-of-state Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be handled with a RST in response. This behavior should allow an at...", "severity": "Low", "prerequisites": ["The adversary needs logical access to the target network. XMAS scanning requires the use of raw sockets, and thus cannot be performed from some Windows systems (Windows XP SP 2, for example). On Unix ..."], "execution_flow": [{"step": "1", "phase": "Experiment", "description": "An adversary sends TCP packets with all flags set but not associated with an existing connection to target ports."}, {"step": "2", "phase": "Experiment", "description": "An adversary uses the response from the target to determine the port's state. If no response is received the port is open. If a RST packet is received then the port is closed."}], "related_cwes": ["CWE-200"]}, "304": {"name": "TCP Null Scan", "abstraction": "Detailed", "status": "Stable", "description": "An adversary uses a TCP NULL scan to determine if ports are closed on the target machine. This scan type is accomplished by sending TCP segments with no flags in the packet header, generating packets that are illegal based on RFC 793. The RFC 793 expected behavior is that any TCP segment with an out-of-state Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be handled with a RST in response. This behavior should allow an attacker to scan...", "severity": "Low", "prerequisites": ["The adversary requires logical access to the target network. NULL scanning requires the use of raw sockets, and thus cannot be performed from some Windows systems (Windows XP SP 2, for example). On Un..."], "execution_flow": [{"step": "1", "phase": "Experiment", "description": "An adversary sends TCP packets with no flags set and that are not associated with an existing connection to target ports."}, {"step": "2", "phase": "Experiment", "description": "An adversary uses the response from the target to determine the port's state. If no response is received the port is open. If a RST packet is received then the port is closed."}], "related_cwes": ["CWE-200"]}, "305": {"name": "TCP ACK Scan", "abstraction": "Detailed", "status": "Stable", "description": "An adversary uses TCP ACK segments to gather information about firewall or ACL configuration. The purpose of this type of scan is to discover information about filter configurations rather than port state. This type of scanning is rarely useful alone, but when combined with SYN scanning, gives a more complete picture of the type of firewall rules that are present.", "severity": "Low", "prerequisites": ["The adversary requires logical access to the target network. ACK scanning requires the use of raw sockets, and thus cannot be performed from some Windows systems (Windows XP SP 2, for example). On Uni..."], "execution_flow": [{"step": "1", "phase": "Experiment", "description": "An adversary sends TCP packets with the ACK flag set and that are not associated with an existing connection to target ports."}, {"step": "2", "phase": "Experiment", "description": "An adversary uses the response from the target to determine the port's state. If a RST packet is received the target port is either closed or the ACK was sent out-of-sync. If no response is received, ..."}], "related_cwes": ["CWE-200"]}, "306": {"name": "TCP Window Scan", "abstraction": "Detailed", "status": "Stable", "description": "An adversary engages in TCP Window scanning to analyze port status and operating system type. TCP Window scanning uses the ACK scanning method but examine the TCP Window Size field of response RST packets to make certain inferences. While TCP Window Scans are fast and relatively stealthy, they work against fewer TCP stack implementations than any other type of scan. Some operating systems return a positive TCP window size when a RST packet is sent from an open port, and a negative value when the...", "severity": "Low", "prerequisites": ["TCP Window scanning requires the use of raw sockets, and thus cannot be performed from some Windows systems (Windows XP SP 2, for example). On Unix and Linux, raw socket manipulations require root pri..."], "execution_flow": [{"step": "1", "phase": "Experiment", "description": "An adversary sends TCP packets with the ACK flag set and that are not associated with an existing connection to target ports."}, {"step": "2", "phase": "Experiment", "description": "An adversary uses the response from the target to determine the port's state. Specifically, the adversary views the TCP window size from the returned RST packet if one was received. Depending on the t..."}], "related_cwes": ["CWE-200"]}, "307": {"name": "TCP RPC Scan", "abstraction": "Detailed", "status": "Stable", "description": "An adversary scans for RPC services listing on a Unix/Linux host.", "severity": "Low", "prerequisites": ["RPC scanning requires no special privileges when it is performed via a native system utility."], "execution_flow": [{"step": "1", "phase": "Experiment", "description": "An adversary sends RCP packets to target ports."}, {"step": "2", "phase": "Experiment", "description": "An adversary uses the response from the target to determine which, if any, RPC service is running on that port. Responses will vary based on which RPC service is running."}], "related_cwes": ["CWE-200"]}, "308": {"name": "UDP Scan", "abstraction": "Detailed", "status": "Stable", "description": "An adversary engages in UDP scanning to gather information about UDP port status on the target system. UDP scanning methods involve sending a UDP datagram to the target port and looking for evidence that the port is closed. Open UDP ports usually do not respond to UDP datagrams as there is no stateful mechanism within the protocol that requires building or establishing a session. Responses to UDP datagrams are therefore application specific and cannot be relied upon as a method of detecting an o...", "severity": "Low", "prerequisites": ["The ability to send UDP datagrams to a host and receive ICMP error messages from that host. In cases where particular types of ICMP messaging is disallowed, the reliability of UDP scanning drops off s..."], "execution_flow": [{"step": "1", "phase": "Experiment", "description": "An adversary sends UDP packets to target ports."}, {"step": "2", "phase": "Experiment", "description": "An adversary uses the response from the target to determine the port's state. Whether a port responds to a UDP packet is dependant on what application is listening on that port. No response does not i..."}], "related_cwes": ["CWE-200"]}, "309": {"name": "Network Topology Mapping", "abstraction": "Standard", "status": "Draft", "description": "An adversary engages in scanning activities to map network nodes, hosts, devices, and routes. Adversaries usually perform this type of network reconnaissance during the early stages of attack against an external network. Many types of scanning utilities are typically employed, including ICMP tools, network mappers, port scanners, and route testing utilities such as traceroute.", "severity": "Low", "prerequisites": ["None"], "related_cwes": ["CWE-200"]}, "31": {"name": "Accessing/Intercepting/Modifying HTTP Cookies", "abstraction": "Detailed", "status": "Draft", "description": "This attack relies on the use of HTTP Cookies to store credentials, state information and other critical data on client systems. There are several different forms of this attack. The first form of this attack involves accessing HTTP Cookies to mine for potentially sensitive data contained therein. The second form involves intercepting this data as it is transmitted from client to server. This intercepted information is then used by the adversary to impersonate the remote user/session. The third ...", "likelihood": "High", "severity": "High", "prerequisites": ["Target server software must be a HTTP daemon that relies on cookies.", "The cookies must contain sensitive information.", "The adversary must be able to make HTTP requests to the server, and the cookie must be contained in the reply."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Obtain copy of cookie] The adversary first needs to obtain a copy of the cookie. The adversary may be a legitimate end user wanting to escalate privilege, or could be somebody sniffing on a network t..."}, {"step": "2", "phase": "Experiment", "description": "[Obtain sensitive information from cookie] The adversary may be able to get sensitive information from the cookie. The web application developers may have assumed that cookies are not accessible by en..."}, {"step": "3", "phase": "Experiment", "description": "[Modify cookie to subvert security controls.] The adversary may be able to modify or replace cookies to bypass security controls in the application."}], "examples": ["There are two main attack vectors for exploiting poorly protected session variables like cookies. One is the local machine itself which can be exploited directly at the physical level or indirectly through XSS and phishing. In addition, the adversary in the middle attack (CAPEC-94) relies on a netwo..."], "related_cwes": ["CWE-565", "CWE-302", "CWE-311", "CWE-113", "CWE-539", "CWE-20", "CWE-315", "CWE-384", "CWE-472", "CWE-602", "CWE-642"]}, "310": {"name": "Scanning for Vulnerable Software", "abstraction": "Detailed", "status": "Draft", "description": "An attacker engages in scanning activity to find vulnerable software versions or types, such as operating system versions or network services. Vulnerable or exploitable network configurations, such as improperly firewalled systems, or misconfigured systems in the DMZ or external network, provide windows of opportunity for an attacker. Common types of vulnerable software include unpatched operating systems or services (e.g FTP, Telnet, SMTP, SNMP) running on open ports that the attacker has ident...", "severity": "Low", "prerequisites": ["Access to the network on which the targeted system resides.", "Software tools used to probe systems over a range of ports and protocols."], "related_cwes": ["CWE-200"]}, "311": {"name": "DEPRECATED: OS Fingerprinting", "abstraction": "Standard", "status": "Deprecated", "description": "This pattern has been deprecated as it was determined to be an unnecessary layer of abstraction. Please refer to the standard level patterns CAPEC-312 : Active OS Fingerprinting or CAPEC-313 : Passive OS Fingerprinting going forward, or to any of the detailed patterns that are children of them."}, "312": {"name": "Active OS Fingerprinting", "abstraction": "Standard", "status": "Stable", "description": "An adversary engages in activity to detect the operating system or firmware version of a remote target by interrogating a device, server, or platform with a probe designed to solicit behavior that will reveal information about the operating systems or firmware in the environment. Operating System detection is possible because implementations of common protocols (Such as IP or TCP) differ in distinct ways. While the implementation differences are not sufficient to 'break' compatibility with the p...", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card."], "related_cwes": ["CWE-200"]}, "313": {"name": "Passive OS Fingerprinting", "abstraction": "Standard", "status": "Stable", "description": "An adversary engages in activity to detect the version or type of OS software in a an environment by passively monitoring communication between devices, nodes, or applications. Passive techniques for operating system detection send no actual probes to a target, but monitor network or client-server communication between nodes in order to identify operating systems based on observed behavior as compared to a database of known signatures or values. While passive OS fingerprinting is not usually as ...", "likelihood": "High", "severity": "Low", "prerequisites": ["The ability to monitor network communications.Access to at least one host, and the privileges to interface with the network interface card."], "related_cwes": ["CWE-200"]}, "314": {"name": "DEPRECATED: IP Fingerprinting Probes", "abstraction": "Standard", "status": "Deprecated", "description": "This pattern has been deprecated as it was determined to be an unnecessary layer of abstraction. Please refer to the standard level pattern CAPEC-312 : Active OS Fingerprinting going forward, or to any of the detailed patterns that children of CAPEC-312."}, "315": {"name": "DEPRECATED: TCP/IP Fingerprinting Probes", "abstraction": "Standard", "status": "Deprecated", "description": "This pattern has been deprecated as it was determined to be an unnecessary layer of abstraction. Please refer to the standard level pattern CAPEC-312 : Active OS Fingerprinting going forward, or to any of the detailed patterns that are children of CAPEC-312."}, "316": {"name": "DEPRECATED: ICMP Fingerprinting Probes", "abstraction": "Standard", "status": "Deprecated", "description": "This pattern has been deprecated as it was determined to be an unnecessary layer of abstraction. Please refer to the standard level pattern CAPEC-312 : Active OS Fingerprinting going forward, or to any of the detailed patterns that are children of CAPEC-312."}, "317": {"name": "IP ID Sequencing Probe", "abstraction": "Detailed", "status": "Stable", "description": "This OS fingerprinting probe analyzes the IP 'ID' field sequence number generation algorithm of a remote host. Operating systems generate IP 'ID' numbers differently, allowing an attacker to identify the operating system of the host by examining how is assigns ID numbers when generating response packets. RFC 791 does not specify how ID numbers are chosen or their ranges, so ID sequence generation differs from implementation to implementation. There are two kinds of IP 'ID' sequence number analys...", "likelihood": "Medium", "severity": "Low", "related_cwes": ["CWE-200"]}, "318": {"name": "IP 'ID' Echoed Byte-Order Probe", "abstraction": "Detailed", "status": "Stable", "description": "This OS fingerprinting probe tests to determine if the remote host echoes back the IP 'ID' value from the probe packet. An attacker sends a UDP datagram with an arbitrary IP 'ID' value to a closed port on the remote host to observe the manner in which this bit is echoed back in the ICMP error message. The identification field (ID) is typically utilized for reassembling a fragmented packet. Some operating systems or router firmware reverse the bit order of the ID field when echoing the IP Header ...", "likelihood": "Medium", "severity": "Low", "related_cwes": ["CWE-200"]}, "319": {"name": "IP (DF) 'Don't Fragment Bit' Echoing Probe", "abstraction": "Detailed", "status": "Stable", "description": "This OS fingerprinting probe tests to determine if the remote host echoes back the IP 'DF' (Don't Fragment) bit in a response packet. An attacker sends a UDP datagram with the DF bit set to a closed port on the remote host to observe whether the 'DF' bit is set in the response packet. Some operating systems will echo the bit in the ICMP error message while others will zero out the bit in the response packet.", "likelihood": "Medium", "severity": "Low", "related_cwes": ["CWE-200"]}, "32": {"name": "XSS Through HTTP Query Strings", "abstraction": "Detailed", "status": "Draft", "description": "An adversary embeds malicious script code in the parameters of an HTTP query string and convinces a victim to submit the HTTP request that contains the query string to a vulnerable web application. The web application then procedes to use the values parameters without properly validation them first and generates the HTML code that will be executed by the victim's browser.", "likelihood": "High", "severity": "High", "prerequisites": ["Target client software must allow scripting such as JavaScript. Server software must allow display of remote generated HTML without sufficient input or output validation."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for public links] Using a browser or an automated tool, an adversary follows all public links on a web site. They record all the links they find."}, {"step": "2", "phase": "Experiment", "description": "[Probe public links for XSS vulnerability] The adversary uses the public links gathered in the \"Explore\" phase as a target list and requests variations on the URLs they spidered before. They send para..."}, {"step": "3", "phase": "Experiment", "description": "[Craft malicious XSS URL] Once the adversary has determined which parameters are vulnerable to XSS, they will craft a malicious URL containing the XSS exploit. The adversary can have many goals, from ..."}, {"step": "4", "phase": "Exploit", "description": "[Get victim to click URL] In order for the attack to be successful, the victim needs to access the malicious URL."}], "examples": ["http://user:host@example.com:8080/oradb<script>alert('Hi')</script>"], "related_cwes": ["CWE-80"]}, "320": {"name": "TCP Timestamp Probe", "abstraction": "Detailed", "status": "Stable", "description": "This OS fingerprinting probe examines the remote server's implementation of TCP timestamps. Not all operating systems implement timestamps within the TCP header, but when timestamps are used then this provides the attacker with a means to guess the operating system of the target. The attacker begins by probing any active TCP service in order to get response which contains a TCP timestamp. Different Operating systems update the timestamp value using different intervals. This type of analysis is m...", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.The target OS must support the TCP timestam..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine if timestamps are present.] The adversary sends a probe packet to the remote host to identify if timestamps are present."}, {"step": "2", "phase": "Experiment", "description": "[Record and analyze timestamp values.] If the remote host is using timestamp, obtain several timestamps, analyze them and compare them to known values."}], "related_cwes": ["CWE-200"]}, "321": {"name": "TCP Sequence Number Probe", "abstraction": "Detailed", "status": "Stable", "description": "This OS fingerprinting probe tests the target system's assignment of TCP sequence numbers. One common way to test TCP Sequence Number generation is to send a probe packet to an open port on the target and then compare the how the Sequence Number generated by the target relates to the Acknowledgement Number in the probe packet. Different operating systems assign Sequence Numbers differently, so a fingerprint of the operating system can be obtained by categorizing the relationship between the ackn...", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card."], "related_cwes": ["CWE-200"]}, "322": {"name": "TCP (ISN) Greatest Common Divisor Probe", "abstraction": "Detailed", "status": "Stable", "description": "This OS fingerprinting probe sends a number of TCP SYN packets to an open port of a remote machine. The Initial Sequence Number (ISN) in each of the SYN/ACK response packets is analyzed to determine the smallest number that the target host uses when incrementing sequence numbers. This information can be useful for identifying an operating system because particular operating systems and versions increment sequence numbers using different values. The result of the analysis is then compared against...", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card."], "related_cwes": ["CWE-200"]}, "323": {"name": "TCP (ISN) Counter Rate Probe", "abstraction": "Detailed", "status": "Stable", "description": "This OS detection probe measures the average rate of initial sequence number increments during a period of time. Sequence numbers are incremented using a time-based algorithm and are susceptible to a timing analysis that can determine the number of increments per unit time. The result of this analysis is then compared against a database of operating systems and versions to determine likely operation system matches.", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card."], "related_cwes": ["CWE-200"]}, "324": {"name": "TCP (ISN) Sequence Predictability Probe", "abstraction": "Detailed", "status": "Stable", "description": "This type of operating system probe attempts to determine an estimate for how predictable the sequence number generation algorithm is for a remote host. Statistical techniques, such as standard deviation, can be used to determine how predictable the sequence number generation is for a system. This result can then be compared to a database of operating system behaviors to determine a likely match for operating system and version.", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card."], "related_cwes": ["CWE-200"]}, "325": {"name": "TCP Congestion Control Flag (ECN) Probe", "abstraction": "Detailed", "status": "Stable", "description": "This OS fingerprinting probe checks to see if the remote host supports explicit congestion notification (ECN) messaging. ECN messaging was designed to allow routers to notify a remote host when signal congestion problems are occurring. Explicit Congestion Notification messaging is defined by RFC 3168. Different operating systems and versions may or may not implement ECN notifications, or may respond uniquely to particular ECN flag types.", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card."], "related_cwes": ["CWE-200"]}, "326": {"name": "TCP Initial Window Size Probe", "abstraction": "Detailed", "status": "Stable", "description": "This OS fingerprinting probe checks the initial TCP Window size. TCP stacks limit the range of sequence numbers allowable within a session to maintain the \"connected\" state within TCP protocol logic. The initial window size specifies a range of acceptable sequence numbers that will qualify as a response to an ACK packet within a session. Various operating systems use different Initial window sizes. The initial window size can be sampled by establishing an ordinary TCP connection.", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card."], "related_cwes": ["CWE-200"]}, "327": {"name": "TCP Options Probe", "abstraction": "Detailed", "status": "Stable", "description": "This OS fingerprinting probe analyzes the type and order of any TCP header options present within a response segment. Most operating systems use unique ordering and different option sets when options are present. RFC 793 does not specify a required order when options are present, so different implementations use unique ways of ordering or structuring TCP options. TCP options can be generated by ordinary TCP traffic.", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card."], "related_cwes": ["CWE-200"]}, "328": {"name": "TCP 'RST' Flag Checksum Probe", "abstraction": "Detailed", "status": "Stable", "description": "This OS fingerprinting probe performs a checksum on any ASCII data contained within the data portion or a RST packet. Some operating systems will report a human-readable text message in the payload of a 'RST' (reset) packet when specific types of connection errors occur. RFC 1122 allows text payloads within reset packets but not all operating systems or routers implement this functionality.", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card."], "related_cwes": ["CWE-200"]}, "329": {"name": "ICMP Error Message Quoting Probe", "abstraction": "Detailed", "status": "Stable", "description": "An adversary uses a technique to generate an ICMP Error message (Port Unreachable, Destination Unreachable, Redirect, Source Quench, Time Exceeded, Parameter Problem) from a target and then analyze the amount of data returned or \"Quoted\" from the originating request that generated the ICMP error message.", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card."], "related_cwes": ["CWE-200"]}, "33": {"name": "HTTP Request Smuggling", "abstraction": "Detailed", "status": "Stable", "likelihood": "Medium", "severity": "High", "prerequisites": ["An additional intermediary HTTP agent such as an application firewall or a web caching proxy between the adversary and the second agent such as a web server, that sends multiple HTTP messages over sam...", "Differences in the way the two HTTP agents parse and interpret HTTP requests and its headers.", "HTTP agents running on HTTP/1.1 that allow for Keep Alive mode, Pipelined queries, and Chunked queries and responses."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey network to identify target] The adversary performs network reconnaissance by monitoring relevant traffic to identify the network path and parsing of the HTTP messages with the goal of identify..."}, {"step": "1", "phase": "Experiment", "description": "[Identify vulnerabilities in targeted HTTP infrastructure and technologies] The adversary sends a variety of benign/ambiguous HTTP requests to observe responses from HTTP infrastructure in order to id..."}, {"step": "2", "phase": "Experiment", "description": "[Cause differential HTTP responses by experimenting with identified HTTP Request vulnerabilities] The adversary sends maliciously crafted HTTP requests to interfere with the parsing of intermediary an..."}, {"step": "1", "phase": "Exploit", "description": "[Perform HTTP Request Smuggling attack] Using knowledge discovered in the experiment section above, smuggle a message to cause one of the consequences."}], "related_cwes": ["CWE-444"]}, "330": {"name": "ICMP Error Message Echoing Integrity Probe", "abstraction": "Detailed", "status": "Stable", "description": "An adversary uses a technique to generate an ICMP Error message (Port Unreachable, Destination Unreachable, Redirect, Source Quench, Time Exceeded, Parameter Problem) from a target and then analyze the integrity of data returned or \"Quoted\" from the originating request that generated the error message.", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card."], "related_cwes": ["CWE-200"]}, "331": {"name": "ICMP IP Total Length Field Probe", "abstraction": "Detailed", "status": "Stable", "description": "An adversary sends a UDP packet to a closed port on the target machine to solicit an IP Header's total length field value within the echoed 'Port Unreachable\" error message. This type of behavior is useful for building a signature-base of operating system responses, particularly when error messages contain other types of information that is useful identifying specific operating system responses.", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The ability to monitor and interact with network communications. Access to at least one host, and the privileges to interface with the network interface card."], "related_cwes": ["CWE-204"]}, "332": {"name": "ICMP IP 'ID' Field Error Message Probe", "abstraction": "Detailed", "status": "Stable", "description": "An adversary sends a UDP datagram having an assigned value to its internet identification field (ID) to a closed port on a target to observe the manner in which this bit is echoed back in the ICMP error message. This allows the attacker to construct a fingerprint of specific OS behaviors.", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The ability to monitor and interact with network communications. Access to at least one host, and the privileges to interface with the network interface card."], "related_cwes": ["CWE-204"]}, "34": {"name": "HTTP Response Splitting", "abstraction": "Detailed", "status": "Stable", "likelihood": "Medium", "severity": "High", "prerequisites": ["A vulnerable or compromised server or domain/site capable of allowing adversary to insert/inject malicious content that will appear in the server's response to target HTTP agents (e.g., proxies and us...", "Differences in the way the two HTTP agents parse and interpret HTTP requests and its headers.", "HTTP headers capable of being user-manipulated.", "HTTP agents running on HTTP/1.0 or HTTP/1.1 that allow for Keep Alive mode, Pipelined queries, and Chunked queries and responses."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey network to identify target] The adversary performs network reconnaissance by monitoring relevant traffic to identify the network path and parsing of the HTTP messages with the goal of identify..."}, {"step": "1", "phase": "Experiment", "description": "[Identify vulnerabilities in targeted HTTP infrastructure and technologies] The adversary sends a variety of benign/ambiguous HTTP requests to observe responses from HTTP infrastructure in order to id..."}, {"step": "2", "phase": "Experiment", "description": "[Cause differential HTTP responses by experimenting with identified HTTP Request vulnerabilities] The adversary sends maliciously crafted HTTP request to back-end HTTP infrastructure to inject adversa..."}, {"step": "1", "phase": "Exploit", "description": "[Perform HTTP Response Splitting attack] Using knowledge discovered in the experiment section above, smuggle a message to cause one of the consequences."}], "related_cwes": ["CWE-74", "CWE-113", "CWE-138", "CWE-436"]}, "35": {"name": "Leverage Executable Code in Non-Executable Files", "abstraction": "Detailed", "status": "Draft", "description": "An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurri...", "likelihood": "High", "severity": "Very High", "prerequisites": ["The attacker must have the ability to modify non-executable files consumed by the target software."], "examples": ["Virtually any system that relies on configuration files for runtime behavior is open to this attack vector. The configuration files are frequently stored in predictable locations, so an attacker that can fingerprint a server process such as a web server or database server can quickly identify the li...", "The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser."], "related_cwes": ["CWE-94", "CWE-96", "CWE-95", "CWE-97", "CWE-272", "CWE-59", "CWE-282", "CWE-270"]}, "36": {"name": "Using Unpublished Interfaces or Functionality", "abstraction": "Standard", "status": "Draft", "description": "An adversary searches for and invokes interfaces or functionality that the target system designers did not intend to be publicly available. If interfaces fail to authenticate requests, the attacker may be able to invoke functionality they are not authorized for.", "likelihood": "Medium", "severity": "High", "prerequisites": ["The architecture under attack must publish or otherwise make available services that clients can attach to, either in an unauthenticated fashion, or having obtained an authentication token elsewhere. ..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify services] Discover a service of interest by exploring service registry listings or by connecting on a known port or some similar means."}, {"step": "2", "phase": "Explore", "description": "[Authenticate to service] Authenticate to the service, if required, in order to explore it."}, {"step": "3", "phase": "Explore", "description": "[Identify all interfaces] Determine the exposed interfaces by querying the registry as well as probably sniffing to expose interfaces that are not explicitly listed."}, {"step": "4", "phase": "Experiment", "description": "[Attempt to discover unpublished functions] Using manual or automated means, discover unpublished or undocumented functions exposed by the service."}, {"step": "5", "phase": "Exploit", "description": "[Exploit unpublished functions] Using information determined via experimentation, exploit the unpublished features of the service."}], "examples": ["To an extent, Google services (such as Google Maps) are all well-known examples. Calling these services, or extending them for one's own (perhaps very different) purposes is as easy as knowing they exist. Their unencumbered public use, however, is a purposeful aspect of Google's business model. Most..."], "related_cwes": ["CWE-306", "CWE-693", "CWE-695", "CWE-1242"]}, "37": {"name": "Retrieve Embedded Sensitive Data", "abstraction": "Detailed", "status": "Draft", "description": "An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.", "likelihood": "High", "severity": "Very High", "prerequisites": ["In order to feasibly execute this type of attack, some valuable data must be present in client software.", "Additionally, this information must be unprotected, or protected in a flawed fashion, or through a mechanism that fails to resist reverse engineering, statistical, or other attack."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify Target] Attacker identifies client components to extract information from. These may be binary executables, class files, shared libraries (e.g., DLLs), configuration files, or other system f..."}, {"step": "2", "phase": "Exploit", "description": "[Retrieve Embedded Data] The attacker then uses a variety of techniques, such as sniffing, reverse-engineering, and cryptanalysis to retrieve the information of interest."}], "examples": ["Using a tool such as 'strings' or similar to pull out text data, perhaps part of a database table, that extends beyond what a particular user's purview should be.", "An attacker can also use a decompiler to decompile a downloaded Java applet in order to look for information such as hardcoded IP addresses, file paths, passwords or other such contents.", "Attacker uses a tool such as a browser plug-in to pull cookie or other token information that, from a previous user at the same machine (perhaps a kiosk), allows the attacker to log in as the previous user."], "related_cwes": ["CWE-226", "CWE-311", "CWE-525", "CWE-312", "CWE-314", "CWE-315", "CWE-318", "CWE-1239", "CWE-1258", "CWE-1266", "CWE-1272", "CWE-1278", "CWE-1301", "CWE-1330"]}, "38": {"name": "Leveraging/Manipulating Configuration File Search Paths", "abstraction": "Detailed", "status": "Draft", "description": "This pattern of attack sees an adversary load a malicious resource into a program's standard path so that when a known command is executed then the system instead executes the malicious component. The adversary can either modify the search path a program uses, like a PATH variable or classpath, or they can manipulate resources on the path to point to their malicious components. J2EE applications and other component based applications that are built from multiple binaries can have very long list ...", "likelihood": "High", "severity": "Very High", "prerequisites": ["The attacker must be able to write to redirect search paths on the victim host."], "related_cwes": ["CWE-426", "CWE-427"]}, "383": {"name": "Harvesting Information via API Event Monitoring", "abstraction": "Detailed", "status": "Draft", "description": "An adversary hosts an event within an application framework and then monitors the data exchanged during the course of the event for the purpose of harvesting any important data leaked during the transactions. One example could be harvesting lists of usernames or userIDs for the purpose of sending spam messages to those users. One example of this type of attack involves the adversary creating an event within the sub-application. Assume the adversary hosts a \"virtual sale\" of rare items. As other ...", "severity": "Low", "prerequisites": ["The target software is utilizing application framework APIs"], "related_cwes": ["CWE-311", "CWE-319", "CWE-419", "CWE-602"]}, "384": {"name": "Application API Message Manipulation via Man-in-the-Middle", "abstraction": "Standard", "status": "Draft", "description": "An attacker manipulates either egress or ingress data from a client within an application framework in order to change the content of messages. Performing this attack can allow the attacker to gain unauthorized privileges within the application, or conduct attacks such as phishing, deceptive strategies to spread malware, or traditional web-application attacks. The techniques require use of specialized software that allow the attacker to perform adversary-in-the-middle (CAPEC-94) communications b...", "severity": "Low", "prerequisites": ["Targeted software is utilizing application framework APIs"], "related_cwes": ["CWE-471", "CWE-345", "CWE-346", "CWE-602", "CWE-311"]}, "385": {"name": "Transaction or Event Tampering via Application API Manipulation", "abstraction": "Detailed", "status": "Draft", "description": "An attacker hosts or joins an event or transaction within an application framework in order to change the content of messages or items that are being exchanged. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that look authentic but may contain deceptive links, substitute one item or another, spoof an existing item and conduct a false exchange, or otherwise change the amounts or identity of what is being exchanged. The techniques r...", "severity": "Medium", "prerequisites": ["Targeted software is utilizing application framework APIs"], "related_cwes": ["CWE-471", "CWE-345", "CWE-346", "CWE-602", "CWE-311"]}, "386": {"name": "Application API Navigation Remapping", "abstraction": "Standard", "status": "Draft", "description": "An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of links/buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains links/buttons that point to an attacker controlled destination. Some applications make navigation remapping more difficult to detect because the ...", "severity": "Medium", "prerequisites": ["Targeted software is utilizing application framework APIs"], "related_cwes": ["CWE-471", "CWE-345", "CWE-346", "CWE-602", "CWE-311"]}, "387": {"name": "Navigation Remapping To Propagate Malicious Content", "abstraction": "Detailed", "status": "Draft", "description": "An adversary manipulates either egress or ingress data from a client within an application framework in order to change the content of messages and thereby circumvent the expected application logic.", "severity": "Medium", "prerequisites": ["Targeted software is utilizing application framework APIs"], "related_cwes": ["CWE-471", "CWE-345", "CWE-346", "CWE-602", "CWE-311"]}, "388": {"name": "Application API Button Hijacking", "abstraction": "Detailed", "status": "Draft", "description": "An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains buttons that point to an attacker controlled destination.", "severity": "Medium", "prerequisites": ["Targeted software is utilizing application framework APIs"], "related_cwes": ["CWE-471", "CWE-345", "CWE-346", "CWE-602", "CWE-311"]}, "389": {"name": "Content Spoofing Via Application API Manipulation", "abstraction": "Detailed", "status": "Draft", "description": "An attacker manipulates either egress or ingress data from a client within an application framework in order to change the content of messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that look authentic but may contain deceptive links, spam-like content, or links to the attackers' code. In general, content-spoofing within an application API can be employed to stage many different types of attacks varied based on the attack...", "severity": "Low", "prerequisites": ["Targeted software is utilizing application framework APIs"], "related_cwes": ["CWE-353"]}, "39": {"name": "Manipulating Opaque Client-based Data Tokens", "abstraction": "Standard", "status": "Draft", "description": "In circumstances where an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) that data can be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker. In this pattern an attacker undermines the assumption that client side tokens have been adequately protected from tampe...", "likelihood": "High", "severity": "Medium", "prerequisites": ["An attacker already has some access to the system or can steal the client based data tokens from another user who has access to the system.", "For an Attacker to viably execute this attack, some data (later interpreted by the application) must be held client-side in a way that can be manipulated without detection. This means that the data or..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Enumerate information passed to client side] The attacker identifies the parameters used as part of tokens to take business or security decisions"}, {"step": "2", "phase": "Explore", "description": "[Determine protection mechanism for opaque token] The attacker determines the protection mechanism used to protect the confidentiality and integrity of these data tokens. They may be obfuscated or a f..."}, {"step": "3", "phase": "Experiment", "description": "[Modify parameter/token values] Trying each parameter in turn, the attacker modifies the values"}, {"step": "4", "phase": "Experiment", "description": "[Cycle through values for each parameter.] Depending on the nature of the application, the attacker now cycles through values of each parameter and observes the effects of this modification in the dat..."}], "examples": ["With certain price watching websites, that aggregate products available prices, the user can buy items through whichever vendors has product availability, the best price, or other differentiator. Once a user selects an item, the site must broker the purchase of that item with the vendor. Because ven...", "Upon successful authentication user is granted an encrypted authentication cookie by the server and it is stored on the client. One piece of information stored in the authentication cookie reflects the access level of the user (e.g. \"u\" for user). The authentication cookie is encrypted using the Ele...", "Archangel Weblog 0.90.02 allows remote attackers to bypass authentication by setting the ba_admin cookie to 1. See also: CVE-2006-0944"], "related_cwes": ["CWE-353", "CWE-285", "CWE-302", "CWE-472", "CWE-565", "CWE-315", "CWE-539", "CWE-384", "CWE-233"]}, "390": {"name": "Bypassing Physical Security", "abstraction": "Meta", "status": "Draft", "description": "Facilities often used layered models for physical security such as traditional locks, Electronic-based card entry systems, coupled with physical alarms. Hardware security mechanisms range from the use of computer case and cable locks as well as RFID tags for tracking computer assets. This layered approach makes it difficult for random physical security breaches to go unnoticed, but is less effective at stopping deliberate and carefully planned break-ins. Avoiding detection begins with evading bu..."}, "391": {"name": "Bypassing Physical Locks", "abstraction": "Standard", "status": "Draft", "description": "An attacker uses techniques and methods to bypass physical security measures of a building or facility. Physical locks may range from traditional lock and key mechanisms, cable locks used to secure laptops or servers, locks on server cases, or other such devices. Techniques such as lock bumping, lock forcing via snap guns, or lock picking can be employed to bypass those locks and gain access to the facilities or devices they protect, although stealth, evidence of tampering, and the integrity of ..."}, "392": {"name": "Lock Bumping", "abstraction": "Detailed", "status": "Draft", "description": "An attacker uses a bump key to force a lock on a building or facility and gain entry. Lock Bumping is the use of a special type of key that can be tapped or bumped to cause the pins within the lock to fall into temporary alignment, allowing the lock to be opened. Lock bumping allows an attacker to open a lock without having the correct key. A standard lock is secured by a set of internal pins that prevent the device from turning. Spring loaded driver pins push down on the key pins. When the corr..."}, "393": {"name": "Lock Picking", "abstraction": "Detailed", "status": "Draft", "description": "An attacker uses lock picking tools and techniques to bypass the locks on a building or facility. Lock picking is the use of a special set of tools to manipulate the pins within a lock. Different sets of tools are required for each type of lock. Lock picking attacks have the advantage of being non-invasive in that if performed correctly the lock will not be damaged. A standard lock pin-and-tumbler lock is secured by a set of internal pins that prevent the tumbler device from turning. Spring load..."}, "394": {"name": "Using a Snap Gun Lock to Force a Lock", "abstraction": "Detailed", "status": "Draft", "description": "An attacker uses a Snap Gun, also known as a Pick Gun, to force the lock on a building or facility. A Pick Gun is a special type of lock picking instrument that works on similar principles as lock bumping. A snap gun is a hand-held device with an attached metal pick. The metal pick strikes the pins within the lock, transferring motion from the key pins to the driver pins and forcing the lock into momentary alignment. A standard lock is secured by a set of internal pins that prevent the device fr..."}, "395": {"name": "Bypassing Electronic Locks and Access Controls", "abstraction": "Standard", "status": "Draft", "description": "An attacker exploits security assumptions to bypass electronic locks or other forms of access controls. Most attacks against electronic access controls follow similar methods but utilize different tools. Some electronic locks utilize magnetic strip cards, others employ RFID tags embedded within a card or badge, or may involve more sophisticated protections such as voice-print, thumb-print, or retinal biometrics. Magnetic Strip and RFID technologies are the most widespread because they are cost e..."}, "396": {"name": "DEPRECATED: Bypassing Card or Badge-Based Systems", "abstraction": "Standard", "status": "Deprecated", "description": "This attack pattern has been deprecated as it a generalization of CAPEC-397: Cloning Magnetic Strip Cards, CAPEC-398: Magnetic Strip Card Brute Force Attacks, CAPEC-399: Cloning RFID Cards or Chips and CAPEC-400: RFID Chip Deactivation or Destruction. Please refer to these CAPECs going forward."}, "397": {"name": "Cloning Magnetic Strip Cards", "abstraction": "Detailed", "status": "Draft", "description": "An attacker duplicates the data on a Magnetic strip card (i.e. 'swipe card' or 'magstripe') to gain unauthorized access to a physical location or a person's private information. Magstripe cards encode data on a band of iron-based magnetic particles arrayed in a stripe along a rectangular card. Most magstripe card data formats conform to ISO standards 7810, 7811, 7813, 8583, and 4909. The primary advantage of magstripe technology is ease of encoding and portability, but this also renders magnetic..."}, "398": {"name": "Magnetic Strip Card Brute Force Attacks", "abstraction": "Detailed", "status": "Draft", "description": "An adversary analyzes the data on two or more magnetic strip cards and is able to generate new cards containing valid sequences that allow unauthorized access and/or impersonation of individuals.", "prerequisites": ["The ability to calculate a card checksum and write out a valid checksum value. Some cards are protected by a checksum calculation, therefore it is necessary to determine what algorithm is being used t..."]}, "399": {"name": "Cloning RFID Cards or Chips", "abstraction": "Detailed", "status": "Draft", "description": "An attacker analyzes data returned by an RFID chip and uses this information to duplicate a RFID signal that responds identically to the target chip. In some cases RFID chips are used for building access control, employee identification, or as markers on products being delivered along a supply chain. Some organizations also embed RFID tags inside computer assets to trigger alarms if they are removed from particular rooms, zones, or buildings. Similar to Magnetic strip cards, RFID cards are susce..."}, "4": {"name": "Using Alternative IP Address Encodings", "abstraction": "Detailed", "status": "Draft", "description": "This attack relies on the adversary using unexpected formats for representing IP addresses. Networked applications may expect network location information in a specific format, such as fully qualified domains names (FQDNs), URL, IP address, or IP Address ranges. If the location information is not validated against a variety of different possible encodings and formats, the adversary can use an alternate format to bypass application access control.", "likelihood": "Medium", "severity": "High", "prerequisites": ["The target software must fail to anticipate all of the possible valid encodings of an IP/web address.", "The adversary must have the ability to communicate with the server."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for IP addresses as user input] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application where IP addresses..."}, {"step": "2", "phase": "Experiment", "description": "[Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and attempts alternate IP address encodings, observing application b..."}, {"step": "3", "phase": "Exploit", "description": "[Bypass access control] Using an alternate IP address encoding, the adversary will either access the application or give the alternate encoding as input, bypassing access control restrictions."}], "examples": ["An adversary identifies an application server that applies a security policy based on the domain and application name. For example, the access control policy covers authentication and authorization for anyone accessing http://example.domain:8080/application. However, by using the IP address of the h..."], "related_cwes": ["CWE-291", "CWE-173"]}, "40": {"name": "Manipulating Writeable Terminal Devices", "abstraction": "Standard", "status": "Draft", "description": "This attack exploits terminal devices that allow themselves to be written to by other users. The attacker sends command strings to the target terminal device hoping that the target user will hit enter and thereby execute the malicious command with their privileges. The attacker can send the results (such as copying /etc/passwd) to a known directory and collect once the attack has succeeded.", "likelihood": "High", "severity": "Very High", "prerequisites": ["User terminals must have a permissive access control such as world writeable that allows normal users to control data on other user's terminals."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify attacker-writable terminals] Determine if users TTYs are writable by the attacker."}, {"step": "2", "phase": "Exploit", "description": "[Execute malicious commands] Using one or more vulnerable TTY, execute commands to achieve various impacts."}], "related_cwes": ["CWE-77"]}, "400": {"name": "RFID Chip Deactivation or Destruction", "abstraction": "Detailed", "status": "Draft", "description": "An attacker uses methods to deactivate a passive RFID tag for the purpose of rendering the tag, badge, card, or object containing the tag unresponsive. RFID tags are used primarily for access control, inventory, or anti-theft devices. The purpose of attacking the RFID chip is to disable or damage the chip without causing damage to the object housing it."}, "401": {"name": "Physically Hacking Hardware", "abstraction": "Standard", "status": "Stable", "description": "An adversary exploits a weakness in access control to gain access to currently installed hardware and precedes to implement changes or secretly replace a hardware component which undermines the system's integrity for the purpose of carrying out an attack.", "likelihood": "Low", "severity": "High", "examples": ["A malicious subcontractor or subcontractor's employee that is responsible for system maintenance secretly replaces a hard drive with one containing malicious code that will allow for backdoor access once deployed."], "related_cwes": ["CWE-1263"]}, "402": {"name": "Bypassing ATA Password Security", "abstraction": "Detailed", "status": "Draft", "description": "An adversary exploits a weakness in ATA security on a drive to gain access to the information the drive contains without supplying the proper credentials. ATA Security is often employed to protect hard disk information from unauthorized access. The mechanism requires the user to type in a password before the BIOS is allowed access to drive contents. Some implementations of ATA security will accept the ATA command to update the password without the user having authenticated with the BIOS. This oc...", "prerequisites": ["Access to the system containing the ATA Drive so that the drive can be physically removed from the system."], "related_cwes": ["CWE-285"]}, "404": {"name": "DEPRECATED: Social Information Gathering Attacks", "abstraction": "Meta", "status": "Deprecated", "description": "This attack pattern has been deprecated as it was deemed not to be a legitimate attack pattern. Please refer to CAPEC-118 : Collect and Analyze Information."}, "405": {"name": "DEPRECATED: Social Information Gathering via Research", "abstraction": "Meta", "status": "Deprecated", "description": "This attack pattern has been deprecated as it was deemed not to be a legitimate attack pattern. Please refer to CAPEC-118 : Collect and Analyze Information."}, "406": {"name": "Dumpster Diving", "abstraction": "Detailed", "status": "Stable", "description": "An adversary cases an establishment and searches through trash bins, dumpsters, or areas where company information may have been accidentally discarded for information items which may be useful to the dumpster diver. The devastating nature of the items and/or information found can be anything from medical records, resumes, personal photos and emails, bank statements, account details or information about software, tech support logs and so much more, including hardware devices. By collecting this ...", "severity": "Low", "prerequisites": ["An adversary must have physical access to the dumpster or downstream processing facility."]}, "407": {"name": "Pretexting", "abstraction": "Standard", "status": "Draft", "description": "An adversary engages in pretexting behavior to solicit information from target persons, or manipulate the target into performing some action that serves the adversary's interests. During a pretexting attack, the adversary creates an invented scenario, assuming an identity or role to persuade a targeted victim to release information or perform some action. It is more than just creating a lie; in some cases it can be creating a whole new identity and then using that identity to manipulate the rece...", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The adversary must have the means and knowledge of how to communicate with the target in some manner.The adversary must have knowledge of the pretext that would influence the actions of the specific t..."], "examples": ["The adversary dresses up like a jogger and runs in place by the entrance of a building, pretending to look for their access card. Because the hood obscures their face, it may be possible to solicit someone inside the building to let them inside."]}, "408": {"name": "DEPRECATED: Information Gathering from Traditional Sources", "abstraction": "Meta", "status": "Deprecated", "description": "This attack pattern has been deprecated as it was deemed not to be a legitimate attack pattern. Please refer to CAPEC-118 : Collect and Analyze Information."}, "409": {"name": "DEPRECATED: Information Gathering from Non-Traditional Sources", "abstraction": "Meta", "status": "Deprecated", "description": "This attack pattern has been deprecated as it was deemed not to be a legitimate attack pattern. Please refer to CAPEC-118 : Collect and Analyze Information."}, "41": {"name": "Using Meta-characters in E-mail Headers to Inject Malicious Payloads", "abstraction": "Detailed", "status": "Draft", "description": "This type of attack involves an attacker leveraging meta-characters in email headers to inject improper behavior into email programs. Email software has become increasingly sophisticated and feature-rich. In addition, email applications are ubiquitous and connected directly to the Web making them ideal targets to launch and propagate attacks. As the user demand for new functionality in email applications grows, they become more like browsers with complex rendering and plug in routines. As more e...", "likelihood": "High", "severity": "High", "prerequisites": ["This attack targets most widely deployed feature rich email applications, including web based email programs."], "execution_flow": [{"step": "1", "phase": "Experiment", "description": "[Identify and characterize metacharacter-processing vulnerabilities in email headers] An attacker creates emails with headers containing various metacharacter-based malicious payloads in order to dete..."}, {"step": "2", "phase": "Exploit", "description": "An attacker leverages vulnerabilities identified during the Experiment Phase to inject malicious email headers and cause the targeted email application to exhibit behavior outside of its expected cons..."}], "related_cwes": ["CWE-150", "CWE-88", "CWE-697"]}, "410": {"name": "Information Elicitation", "abstraction": "Meta", "status": "Draft", "description": "An adversary engages an individual using any combination of social engineering methods for the purpose of extracting information. Accurate contextual and environmental queues, such as knowing important information about the target company or individual can greatly increase the success of the attack and the quality of information gathered. Authentic mimicry combined with detailed knowledge increases the success of elicitation attacks.", "severity": "Low"}, "411": {"name": "DEPRECATED: Pretexting", "abstraction": "Meta", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of the existing attack pattern \"CAPEC-407 : Social Information Gathering via Pretexting\". Please refer to this other CAPEC going forward."}, "412": {"name": "Pretexting via Customer Service", "abstraction": "Detailed", "status": "Draft", "description": "An adversary engages in pretexting behavior, assuming the role of someone who works for Customer Service, to solicit information from target persons, or manipulate the target into performing an action that serves the adversary's interests. One example of a scenario such as this would be to call an individual, articulate your false affiliation with a credit card company, and then attempt to get the individual to verify their credit card number.", "severity": "Low"}, "413": {"name": "Pretexting via Tech Support", "abstraction": "Detailed", "status": "Draft", "description": "An adversary engages in pretexting behavior, assuming the role of a tech support worker, to solicit information from target persons, or manipulate the target into performing an action that serves the adversary's interests. An adversary who uses social engineering to impersonate a tech support worker can have devastating effects on a network. This is an effective attack vector, because it can give an adversary physical access to network computers. It only takes a matter of seconds for someone to ...", "severity": "Low"}, "414": {"name": "Pretexting via Delivery Person", "abstraction": "Detailed", "status": "Draft", "description": "An adversary engages in pretexting behavior, assuming the role of a delivery person, to solicit information from target persons, or manipulate the target into performing an action that serves the adversary's interests. Impersonating a delivery person is an effective attack and an easy attack since not much acting is involved. Usually the hardest part is looking the part and having all of the proper credentials, papers and \"deliveries\" in order to be able to pull it off.", "severity": "Low"}, "415": {"name": "Pretexting via Phone", "abstraction": "Detailed", "status": "Draft", "description": "An adversary engages in pretexting behavior, assuming some sort of trusted role, and contacting the targeted individual or organization via phone to solicit information from target persons, or manipulate the target into performing an action that serves the adversary's interests. This is the most common social engineering attack. Some of the most commonly effective approaches are to impersonate a fellow employee, impersonate a computer technician or to target help desk personnel.", "severity": "Low"}, "416": {"name": "Manipulate Human Behavior", "abstraction": "Meta", "status": "Stable", "description": "An adversary exploits inherent human psychological predisposition to influence a targeted individual or group to solicit information or manipulate the target into performing an action that serves the adversary's interests. Many interpersonal social engineering techniques do not involve outright deception, although they can; many are subtle ways of manipulating a target to remove barriers, make the target feel comfortable, and produce an exchange in which the target is either more likely to share...", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The adversary must have the means and knowledge of how to communicate with the target in some manner."]}, "417": {"name": "Influence Perception", "abstraction": "Standard", "status": "Stable", "description": "The adversary uses social engineering to exploit the target's perception of the relationship between the adversary and themselves. This goal is to persuade the target to unknowingly perform an action or divulge information that is advantageous to the adversary.", "likelihood": "High", "severity": "Low", "prerequisites": ["The adversary must have the means and knowledge of how to communicate with the target in some manner."]}, "418": {"name": "Influence Perception of Reciprocation", "abstraction": "Detailed", "status": "Draft", "description": "An adversary uses a social engineering techniques to produce a sense of obligation in the target to perform a certain action or concede some sensitive or key piece of information. Obligation has to do with actions one feels they need to take due to some sort of social, legal, or moral requirement, duty, contract, or promise. There are various techniques for fostering a sense of obligation to reciprocate or concede during ordinary modes of communication. One method is to compliment the target, an...", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The adversary must have the means and knowledge of how to communicate with the target in some manner."], "examples": ["An adversary develops a relationship with the target to foster a feeling of obligation in them to perform a certain action or concede some information. A perception of obligation/concession means that the target feels they need to behave in some way or perform some sort of action due to being morall..."]}, "419": {"name": "DEPRECATED: Target Influence via Perception of Concession", "abstraction": "Meta", "status": "Deprecated", "description": "This attack pattern has been deprecated as it was deemed not to be a legitimate pattern."}, "42": {"name": "MIME Conversion", "abstraction": "Detailed", "status": "Draft", "description": "An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.", "likelihood": "High", "severity": "High", "prerequisites": ["The target system uses a mail server.", "Mail server vendor has not released a patch for the MIME conversion routine, the patch itself has a security hole or does not fix the original problem, or the patch has not been applied to the user's ..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target mail server] The adversary identifies a target mail server that they wish to attack."}, {"step": "2", "phase": "Explore", "description": "[Determine viability of attack] Determine whether the mail server is unpatched and is potentially vulnerable to one of the known MIME conversion buffer overflows (e.g. Sendmail 8.8.3 and 8.8.4)."}, {"step": "3", "phase": "Experiment", "description": "[Find injection vector] Identify places in the system where vulnerable MIME conversion routines may be used."}, {"step": "4", "phase": "Experiment", "description": "[Craft overflow content] The adversary crafts e-mail messages with special headers that will cause a buffer overflow for the vulnerable MIME conversion routine. The intent of this attack is to leverag..."}, {"step": "4", "phase": "Exploit", "description": "[Overflow the buffer] Send e-mail messages to the target system with specially crafted headers that trigger the buffer overflow and execute the shell code."}], "related_cwes": ["CWE-120", "CWE-119", "CWE-74", "CWE-20"]}, "420": {"name": "Influence Perception of Scarcity", "abstraction": "Detailed", "status": "Stable", "description": "The adversary leverages a perception of scarcity to persuade the target to perform an action or divulge information that is advantageous to the adversary. By conveying a perception of scarcity, or a situation of limited supply, the adversary aims to create a sense of urgency in the context of a target's decision-making process.", "likelihood": "High", "severity": "Low", "prerequisites": ["The adversary must have the means and knowledge of how to communicate with the target in some manner."], "examples": ["An adversary sends an email to a target about a limited-time opportunity to claim a considerable monetary reward. The email contains a link to a site which the adversary says is only active for a short time and to the first person to claim it. By convincing the user of the scarcity of the monetary r..."]}, "421": {"name": "Influence Perception of Authority", "abstraction": "Detailed", "status": "Stable", "description": "An adversary uses a social engineering technique to convey a sense of authority that motivates the target to reveal specific information or take specific action. There are various techniques for producing a sense of authority during ordinary modes of communication. One common method is impersonation. By impersonating someone with a position of power within an organization, an adversary may motivate the target individual to reveal some piece of sensitive information or perform an action that bene...", "likelihood": "High", "severity": "Low", "prerequisites": ["The adversary must have the means and knowledge of how to communicate with the target in some manner."], "examples": ["The adversary calls the target and announces that they are the head of IT at the target's company. The adversary goes on to say that there has been a technical issue and they need the target's login credentials for their account. By convincing the target of their authority, the adversary hopes the t..."]}, "422": {"name": "Influence Perception of Commitment and Consistency", "abstraction": "Detailed", "status": "Stable", "description": "An adversary uses social engineering to convince the target to do minor tasks as opposed to larger actions. After complying with a request, individuals are more likely to agree to subsequent requests that are similar in type and required effort.", "likelihood": "High", "severity": "Low", "prerequisites": ["The adversary must have the means and knowledge of how to communicate with the target in some manner."]}, "423": {"name": "Influence Perception of Liking", "abstraction": "Detailed", "status": "Stable", "description": "The adversary influences the target's actions by building a relationship where the target has a liking to the adversary. People are more likely to be influenced by people of whom they are fond, so the adversary attempts to ingratiate themself with the target via actions, appearance, or a combination thereof.", "likelihood": "Medium", "severity": "Low", "prerequisites": ["The adversary must have the means and knowledge of how to communicate with the target in some manner.The adversary must have knowledge of the types of things that the target likes."]}, "424": {"name": "Influence Perception of Consensus or Social Proof", "abstraction": "Detailed", "status": "Draft", "description": "The adversary influences the target's actions by leveraging the inherent human nature to assume behavior of others is appropriate. In situations of uncertainty, people tend to behave in ways they see others behaving. The adversary convinces the target of adopting behavior or actions that is advantageous to the adversary.", "likelihood": "Low", "severity": "Low", "prerequisites": ["The adversary must have the means and knowledge of how to communicate with the target in some manner."]}, "425": {"name": "Target Influence via Framing", "abstraction": "Standard", "status": "Draft", "description": "An adversary uses framing techniques to contextualize a conversation so that the target is more likely to be influenced by the adversary's point of view. Framing is information and experiences in life that alter the way we react to decisions we must make. This type of persuasive technique exploits the way people are conditioned to perceive data and its significance, while avoiding negative or avoidance responses from the target. Rather than a specific technique framing is a methodology of conver...", "likelihood": "Low", "severity": "Low", "prerequisites": ["The adversary must have the means and knowledge of how to communicate with the target in some manner."]}, "426": {"name": "Influence via Incentives", "abstraction": "Standard", "status": "Stable", "description": "The adversary incites a behavior from the target by manipulating something of influence. This is commonly associated with financial, social, or ideological incentivization. Examples include monetary fraud, peer pressure, and preying on the target's morals or ethics. The most effective incentive against one target might not be as effective against another, therefore the adversary must gather information about the target's vulnerability to particular incentives.", "likelihood": "Low", "severity": "Low", "prerequisites": ["The adversary must have the means and knowledge of how to communicate with the target in some manner.The adversary must have knowledge of the incentives that would influence the actions of the specifi..."]}, "427": {"name": "Influence via Psychological Principles", "abstraction": "Standard", "status": "Draft", "description": "The adversary shapes the target's actions or behavior by focusing on the ways human interact and learn, leveraging such elements as cognitive and social psychology. In a variety of ways, a target can be influenced to behave or perform an action through capitalizing on what scholarship and research has learned about how and why humans react to specific scenarios and cues.", "likelihood": "Low", "severity": "Low", "prerequisites": ["The adversary must have the means and knowledge of how to communicate with the target in some manner."]}, "428": {"name": "Influence via Modes of Thinking", "abstraction": "Detailed", "status": "Draft", "description": "The adversary tailors their communication to the language and thought patterns of the target thereby weakening barriers or reluctance to communication. This method is a way of building rapport with a target by matching their speech patterns and the primary ways or dominant senses with which they make abstractions. This technique can be used to make the target more receptive to sharing information because the adversary has adapted their communication forms to match those of the target. When skill...", "severity": "Low"}, "429": {"name": "Target Influence via Eye Cues", "abstraction": "Detailed", "status": "Draft", "description": "The adversary gains information via non-verbal means from the target through eye movements.", "severity": "Low"}, "43": {"name": "Exploiting Multiple Input Interpretation Layers", "abstraction": "Detailed", "status": "Draft", "description": "An attacker supplies the target software with input data that contains sequences of special characters designed to bypass input validation logic. This exploit relies on the target making multiples passes over the input data and processing a \"layer\" of special characters with each pass. In this manner, the attacker can disguise input that would otherwise be rejected as invalid by concealing it with layers of special/escape characters that are stripped off by subsequent processing steps. The goal ...", "likelihood": "Medium", "severity": "High", "prerequisites": ["User input is used to construct a command to be executed on the target system or as part of the file name.", "Multiple parser passes are performed on the data supplied by the user."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine application/system inputs where bypassing input validation is desired] The attacker first needs to determine all of the application's/system's inputs where input validation is being perform..."}, {"step": "2", "phase": "Experiment", "description": "[Determine which character encodings are accepted by the application/system] The attacker then needs to provide various character encodings to the application/system and determine which ones are accep..."}, {"step": "3", "phase": "Experiment", "description": "[Combine multiple encodings accepted by the application.] The attacker now combines encodings accepted by the application. The attacker may combine different encodings or apply the same encoding multi..."}, {"step": "4", "phase": "Exploit", "description": "[Leverage ability to bypass input validation] Attacker leverages their ability to bypass input validation to gain unauthorized access to system. There are many attacks possible, and a few examples are..."}], "related_cwes": ["CWE-179", "CWE-181", "CWE-184", "CWE-183", "CWE-77", "CWE-78", "CWE-74", "CWE-20", "CWE-697", "CWE-707"]}, "430": {"name": "DEPRECATED:  Target Influence via Micro-Expressions", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated."}, "431": {"name": "DEPRECATED:  Target Influence via Neuro-Linguistic Programming (NLP)", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated."}, "432": {"name": "DEPRECATED:  Target Influence via Voice in NLP", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated."}, "433": {"name": "Target Influence via The Human Buffer Overflow", "abstraction": "Detailed", "status": "Draft", "description": "An attacker utilizes a technique to insinuate commands to the subconscious mind of the target via communication patterns. The human buffer overflow methodology does not rely on over-stimulating the mind of the target, but rather embedding messages within communication that the mind of the listener assembles at a subconscious level. The human buffer-overflow method is similar to subconscious programming to the extent that messages are embedded within the message.", "severity": "Low"}, "434": {"name": "Target Influence via Interview and Interrogation", "abstraction": "Detailed", "status": "Draft", "severity": "Low"}, "435": {"name": "Target Influence via Instant Rapport", "abstraction": "Detailed", "status": "Draft", "severity": "Low"}, "438": {"name": "Modification During Manufacture", "abstraction": "Meta", "status": "Draft", "description": "An attacker modifies a technology, product, or component during a stage in its manufacture for the purpose of carrying out an attack against some entity involved in the supply chain lifecycle. There are an almost limitless number of ways an attacker can modify a technology when they are involved in its manufacture, as the attacker has potential inroads to the software composition, hardware design and assembly, firmware, or basic design mechanics. Additionally, manufacturing of key components is ..."}, "439": {"name": "Manipulation During Distribution", "abstraction": "Meta", "status": "Draft", "description": "An attacker undermines the integrity of a product, software, or technology at some stage of the distribution channel. The core threat of modification or manipulation during distribution arise from the many stages of distribution, as a product may traverse multiple suppliers and integrators as the final asset is delivered. Components and services provided from a manufacturer to a supplier may be tampered with during integration or packaging.", "examples": ["A malicious OEM provider, or OEM provider employee or contractor, may install software, or modify existing code, during distribution.", "External contractors involved in the packaging or testing of products or components may install software, or modify existing code, during distribution."], "related_cwes": ["CWE-1269"]}, "44": {"name": "Overflow Binary Resource File", "abstraction": "Detailed", "status": "Draft", "description": "An attack of this type exploits a buffer overflow vulnerability in the handling of binary resources. Binary resources may include music files like MP3, image files like JPEG files, and any other binary file. These attacks may pass unnoticed to the client machine through normal usage of files, such as a browser loading a seemingly innocent JPEG file. This can allow the adversary access to the execution stack and execute arbitrary code in the target process.", "likelihood": "High", "severity": "Very High", "prerequisites": ["Target software processes binary resource files.", "Target software contains a buffer overflow vulnerability reachable through input from a user-controllable binary resource file."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target software] The adversary identifies software that uses external binary files in some way. This could be a file upload, downloading a file from a shared location, or other means."}, {"step": "2", "phase": "Experiment", "description": "[Find injection vector] The adversary creates a malicious binary file by altering the header to make the file seem shorter than it is. Additional bytes are added to the end of the file to be placed in..."}, {"step": "3", "phase": "Experiment", "description": "[Craft overflow content] Once the adversary has determined that this attack is viable, they will specially craft the binary file in a way that achieves the desired behavior. If the source code is avai..."}, {"step": "4", "phase": "Exploit", "description": "[Overflow the buffer] Once the adversary has constructed a file that will effectively overflow the targeted software in the intended way. The file is deployed to the software, either by serving it dir..."}], "examples": ["Binary files like music and video files are appended with additional data to cause buffer overflow on target systems. Because these files may be filled with otherwise popular content, the adversary has an excellent vector for wide distribution. There have been numerous cases, for example of maliciou..."], "related_cwes": ["CWE-120", "CWE-119", "CWE-697"]}, "440": {"name": "Hardware Integrity Attack", "abstraction": "Meta", "status": "Stable", "description": "An adversary exploits a weakness in the system maintenance process and causes a change to be made to a technology, product, component, or sub-component or a new one installed during its deployed use at the victim location for the purpose of carrying out an attack.", "likelihood": "Low", "severity": "High", "prerequisites": ["Influence over the deployed system at a victim location."]}, "441": {"name": "Malicious Logic Insertion", "abstraction": "Meta", "status": "Stable", "description": "An adversary installs or adds malicious logic (also known as malware) into a seemingly benign component of a fielded system. This logic is often hidden from the user of the system and works behind the scenes to achieve negative impacts. With the proliferation of mass digital storage and inexpensive multimedia devices, Bluetooth and 802.11 support, new attack vectors for spreading malware are emerging for things we once thought of as innocuous greeting cards, picture frames, or digital projectors...", "likelihood": "Medium", "severity": "High", "prerequisites": ["Access to the component currently deployed at a victim location."], "related_cwes": ["CWE-284"]}, "442": {"name": "Infected Software", "abstraction": "Standard", "status": "Stable", "description": "An adversary adds malicious logic, often in the form of a computer virus, to otherwise benign software. This logic is often hidden from the user of the software and works behind the scenes to achieve negative impacts. Many times, the malicious logic is inserted into empty space between legitimate code, and is then called when the software is executed. This pattern of attack focuses on software already fielded and used in operation as opposed to software that is still under development and part o...", "likelihood": "Medium", "severity": "High", "prerequisites": ["Access to the software currently deployed at a victim location. This access is often obtained by leveraging another attack pattern to gain permissions that the adversary wouldn't normally have."], "related_cwes": ["CWE-506"]}, "443": {"name": "Malicious Logic Inserted Into Product by Authorized Developer", "abstraction": "Detailed", "status": "Stable", "description": "An adversary uses their privileged position within an authorized development organization to inject malicious logic into a codebase or product.", "likelihood": "Medium", "severity": "High", "prerequisites": ["Access to the product during the initial or continuous development."], "examples": ["During initial development, an authorized hardware developer implants a malicious microcontroller within an Internet of Things (IOT) device and programs the microcontroller to communicate with the vulnerable device. Each time the device initializes, the malicious microcontroller's code is executed, ..."]}, "444": {"name": "Development Alteration", "abstraction": "Standard", "status": "Stable", "description": "An adversary modifies a technology, product, or component during its development to acheive a negative impact once the system is deployed. The goal of the adversary is to modify the system in such a way that the negative impact can be leveraged when the system is later deployed. Development alteration attacks may include attacks that insert malicious logic into the system's software, modify or replace hardware components, and other attacks which negatively impact the system during development. T...", "likelihood": "Medium", "severity": "High", "prerequisites": ["Access to the system during the development phase to alter and/or modify software and hardware components. This access is often obtained via insider access or by leveraging another attack pattern to g..."]}, "445": {"name": "Malicious Logic Insertion into Product Software via Configuration Management Manipulation", "abstraction": "Detailed", "status": "Stable", "likelihood": "Medium", "severity": "High", "prerequisites": ["Access to the configuration management system during deployment or currently deployed at a victim location. This access is often obtained via insider access or by leveraging another attack pattern to ..."]}, "446": {"name": "Malicious Logic Insertion into Product via Inclusion of Third-Party Component", "abstraction": "Detailed", "status": "Stable", "likelihood": "Medium", "severity": "High", "prerequisites": ["Access to the product during the initial or continuous development. This access is often obtained via insider access to include the third-party component after deployment."]}, "447": {"name": "Design Alteration", "abstraction": "Standard", "status": "Stable", "description": "An adversary modifies the design of a technology, product, or component to acheive a negative impact once the system is deployed. In this type of attack, the goal of the adversary is to modify the design of the system, prior to development starting, in such a way that the negative impact can be leveraged when the system is later deployed. Design alteration attacks differ from development alteration attacks in that design alteration attacks take place prior to development and which then may or ma...", "likelihood": "Medium", "severity": "High", "prerequisites": ["Access to system design documentation prior to the development phase. This access is often obtained via insider access or by leveraging another attack pattern to gain permissions that the adversary wo...", "Ability to forge web communications to deliver modified design documentation."]}, "448": {"name": "Embed Virus into DLL", "abstraction": "Detailed", "status": "Stable", "description": "An adversary tampers with a DLL and embeds a computer virus into gaps between legitimate machine instructions. These gaps may be the result of compiler optimizations that pad memory blocks for performance gains. The embedded virus then attempts to infect any machine which interfaces with the product, and possibly steal private data or eavesdrop.", "likelihood": "Medium", "severity": "High", "prerequisites": ["Access to the software currently deployed at a victim location. This access is often obtained by leveraging another attack pattern to gain permissions that the adversary wouldn't normally have."], "related_cwes": ["CWE-506"]}, "449": {"name": "DEPRECATED: Malware Propagation via USB Stick", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of CAPEC-448 : Malware Infection into Product Software. Please refer to this other pattern going forward."}, "45": {"name": "Buffer Overflow via Symbolic Links", "abstraction": "Detailed", "status": "Draft", "description": "This type of attack leverages the use of symbolic links to cause buffer overflows. An adversary can try to create or manipulate a symbolic link file such that its contents result in out of bounds data. When the target software processes the symbolic link file, it could potentially overflow internal buffers with insufficient bounds checking.", "likelihood": "High", "severity": "High", "prerequisites": ["The adversary can create symbolic link on the target host.", "The target host does not perform correct boundary checking while consuming data from a resources."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target application] The adversary identifies a target application or program that might load in certain files to memory."}, {"step": "2", "phase": "Experiment", "description": "[Find injection vector] The adversary identifies an injection vector to deliver the excessive content to the targeted application's buffer."}, {"step": "3", "phase": "Experiment", "description": "[Craft overflow file content] The adversary crafts the content to be injected. If the intent is to simply cause the software to crash, the content need only consist of an excessive quantity of random ..."}, {"step": "4", "phase": "Exploit", "description": "[Overflow the buffer] Using the specially crafted file content, the adversary creates a symbolic link from the identified resource to the malicious file, causing a targeted buffer overflow attack."}], "related_cwes": ["CWE-120", "CWE-285", "CWE-302", "CWE-118", "CWE-119", "CWE-74", "CWE-20", "CWE-680", "CWE-697"]}, "450": {"name": "DEPRECATED: Malware Propagation via USB U3 Autorun", "abstraction": "Standard", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of CAPEC-448 : Embed Virus into DLL. Please refer to this other pattern going forward."}, "451": {"name": "DEPRECATED: Malware Propagation via Infected Peripheral Device", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of CAPEC-448 : Malware Infection into Product Software. Please refer to this other pattern going forward."}, "452": {"name": "Infected Hardware", "abstraction": "Standard", "status": "Stable", "description": "An adversary inserts malicious logic into hardware, typically in the form of a computer virus or rootkit. This logic is often hidden from the user of the hardware and works behind the scenes to achieve negative impacts. This pattern of attack focuses on hardware already fielded and used in operation as opposed to hardware that is still under development and part of the supply chain.", "likelihood": "Medium", "severity": "High", "prerequisites": ["Access to the hardware currently deployed at a victim location."]}, "453": {"name": "DEPRECATED: Malicious Logic Insertion via Counterfeit Hardware", "abstraction": "Standard", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of CAPEC-452 : Malicious Logic Insertion into Product Hardware. Please refer to this other pattern going forward."}, "454": {"name": "DEPRECATED: Modification of Existing Components with Counterfeit Hardware", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of CAPEC-452 : Malicious Logic Insertion into Product Hardware. Please refer to this other pattern going forward."}, "455": {"name": "DEPRECATED: Malicious Logic Insertion via Inclusion of Counterfeit Hardware Components", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of CAPEC-457 : Malicious Logic Insertion into Product Hardware. Please refer to this other pattern going forward."}, "456": {"name": "Infected Memory", "abstraction": "Standard", "status": "Stable", "description": "An adversary inserts malicious logic into memory enabling them to achieve a negative impact. This logic is often hidden from the user of the system and works behind the scenes to achieve negative impacts. This pattern of attack focuses on systems already fielded and used in operation as opposed to systems that are still under development and part of the supply chain.", "likelihood": "Medium", "severity": "High", "examples": ["A USB Memory stick has malicious logic inserted before shipping of the product allowing for infection of the host machine once inserted into the USB port.", "In 2007, approximately 1800 of Seagate's Maxtor Personal Storage 3200 drives were built under contract with an outside manufacturer and contained a virus that stole user passwords."], "related_cwes": ["CWE-1257", "CWE-1260", "CWE-1274", "CWE-1312", "CWE-1316"]}, "457": {"name": "USB Memory Attacks", "abstraction": "Detailed", "status": "Draft", "description": "An adversary loads malicious code onto a USB memory stick in order to infect any system which the device is plugged in to. USB drives present a significant security risk for business and government agencies. Given the ability to integrate wireless functionality into a USB stick, it is possible to design malware that not only steals confidential data, but sniffs the network, or monitor keystrokes, and then exfiltrates the stolen data off-site via a Wireless connection. Also, viruses can be transm...", "likelihood": "Low", "severity": "High", "prerequisites": ["Some level of physical access to the device being attacked.", "Information pertaining to the target organization on how to best execute a USB Drop Attack."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine Target System] In certain cases, the adversary will explore an organization's network to determine a specific target machine to exploit based on the information it contains or privileges th..."}, {"step": "2", "phase": "Experiment", "description": "[Develop or Obtain malware and install on a USB device] The adversary develops or obtains the malicious software necessary to exploit the target system, which they then install on an external USB devi..."}, {"step": "3", "phase": "Exploit", "description": "[Connect or deceive a user into connecting the infected USB device] Once the malware has been placed on an external USB device, the adversary connects the device to the target system or deceives a use..."}], "related_cwes": ["CWE-1299"]}, "458": {"name": "Flash Memory Attacks", "abstraction": "Detailed", "status": "Draft", "description": "An adversary inserts malicious logic into a product or technology via flashing the on-board memory with a code-base that contains malicious logic. Various attacks exist against the integrity of flash memory, the most direct being rootkits coded into the BIOS or chipset of a device.", "related_cwes": ["CWE-1282"]}, "459": {"name": "Creating a Rogue Certification Authority Certificate", "abstraction": "Detailed", "status": "Draft", "description": "An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their \"to be signed\" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob...", "likelihood": "Medium", "severity": "Very High", "prerequisites": ["Certification Authority is using a hash function with insufficient collision resistance to generate the certificate hash to be signed"], "execution_flow": [{"step": "1", "phase": "Experiment", "description": "[Craft Certificates] The adversary crafts two different, but valid X.509 certificates that when hashed with an insufficiently collision resistant hashing algorithm would yield the same value."}, {"step": "2", "phase": "Experiment", "description": "[Send CSR to Certificate Authority] The adversary sends the CSR for one of the certificates to the Certification Authority which uses the targeted hashing algorithm. That request is completely valid a..."}, {"step": "3", "phase": "Exploit", "description": "[Insert Signed Blob into Unsigned Certificate] The adversary takes the signed blob and inserts it into the second X.509 certificate that the attacker generated. Due to the hash collision, both certifi..."}], "related_cwes": ["CWE-327", "CWE-295", "CWE-290"]}, "46": {"name": "Overflow Variables and Tags", "abstraction": "Detailed", "status": "Draft", "description": "This type of attack leverages the use of tags or variables from a formatted configuration data to cause buffer overflow. The adversary crafts a malicious HTML page or configuration file that includes oversized strings, thus causing an overflow.", "likelihood": "High", "severity": "High", "prerequisites": ["The target program consumes user-controllable data in the form of tags or variables.", "The target program does not perform sufficient boundary checking."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target application] The adversary identifies a target application or program to perform the buffer overflow on. Adversaries look for applications or programs that accept formatted files, suc..."}, {"step": "2", "phase": "Experiment", "description": "[Find injection vector] The adversary identifies an injection vector to deliver the excessive content to the targeted application's buffer."}, {"step": "3", "phase": "Experiment", "description": "[Craft overflow content] The adversary crafts the content to be injected. If the intent is to simply cause the software to crash, the content need only consist of an excessive quantity of random data...."}, {"step": "4", "phase": "Exploit", "description": "[Overflow the buffer] The adversary will upload the crafted file to the application, causing a buffer overflow."}], "related_cwes": ["CWE-120", "CWE-118", "CWE-119", "CWE-74", "CWE-20", "CWE-680", "CWE-733", "CWE-697"]}, "460": {"name": "HTTP Parameter Pollution (HPP)", "abstraction": "Detailed", "status": "Draft", "description": "An adversary adds duplicate HTTP GET/POST parameters by injecting query string delimiters. Via HPP it may be possible to override existing hardcoded HTTP parameters, modify the application behaviors, access and, potentially exploit, uncontrollable variables, and bypass input validation checkpoints and WAF rules.", "severity": "Medium", "prerequisites": ["HTTP protocol is used with some GET/POST parameters passed"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find User Input] The adversary finds anywhere in the web application that uses user-supplied input in a form or action. This can also be found by looking at parameters in the URL in the navigation ba..."}, {"step": "2", "phase": "Experiment", "description": "[Add Duplicate Parameter Values] Once the adversary has identified what user input is used as HTTP parameters, they will add duplicates to each parameter one by one to observe the results. If the resp..."}, {"step": "3", "phase": "Exploit", "description": "[Leverage HPP] Once the adversary has identified how the backend handles duplicate parameters, they will leverage this by polluting the paramters in a way that benefits them. In some cases, hardcoded ..."}], "related_cwes": ["CWE-88", "CWE-147", "CWE-235"]}, "461": {"name": "Web Services API Signature Forgery Leveraging Hash Function Extension Weakness", "abstraction": "Standard", "status": "Draft", "description": "An adversary utilizes a hash function extension/padding weakness, to modify the parameters passed to the web service requesting authentication by generating their own call in order to generate a legitimate signature hash (as described in the notes), without knowledge of the secret token sometimes provided by the web service.", "severity": "High", "prerequisites": ["Web services check the signature of the API calls", "Authentication tokens / secrets are shared between the server and the legitimate client", "The API call signature is generated by concatenating the parameter list with the shared secret and hashing the result.", "An iterative hash function like MD5 and SHA1 is used.", "An attacker is able to intercept or in some other way gain access to the information passed between the legitimate client and the server in order to retrieve the hash value and length of the original ...", "The communication channel between the client and the server is not secured via channel security such as TLS"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find a vulnerable web service] The adversary finds a web service that uses a vulnerable authentication scheme, where an authentication token is concatenated with the parameters of a request and then ..."}, {"step": "2", "phase": "Experiment", "description": "[Attempt adding padding to parameters] An adversary tests if they can simply add padding to the parameters of a request such that the request is technically changed, with the hash remaining the same"}, {"step": "3", "phase": "Exploit", "description": "[Add malicious parameters to request] Add malicious parameters to a captured request in addition to what is already present. Do this by exploiting the padding weakness of the hash function and send th..."}], "examples": ["To leverage an attack against the has function extension / padding weakness, consider the message to be passed to the web service is M (this message includes the parameters passed to the web service concatenated with the secret token / key bytes). The message M is hashed and that hash is passed to t..."], "related_cwes": ["CWE-328", "CWE-290"]}, "462": {"name": "Cross-Domain Search Timing", "abstraction": "Detailed", "status": "Draft", "description": "An attacker initiates cross domain HTTP / GET requests and times the server responses. The timing of these responses may leak important information on what is happening on the server. Browser's same origin policy prevents the attacker from directly reading the server responses (in the absence of any other weaknesses), but does not prevent the attacker from timing the responses to requests that the attacker issued cross domain.", "severity": "Medium", "prerequisites": ["Ability to issue GET / POST requests cross domainJava Script is enabled in the victim's browserThe victim has an active session with the site from which the attacker would like to receive informationT..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine service to send cross domain requests to] The adversary first determines which service they will be sending the requests to"}, {"step": "2", "phase": "Experiment", "description": "[Send and time various cross domain requests] Adversaries will send a variety of cross domain requests to the target, timing the time it takes for the target to respond. Although they won't be able to..."}, {"step": "3", "phase": "Exploit", "description": "[Infer information from the response time] After obtaining reponse times to various requests, the adversary will compare these times and infer potentially sensitive information. An example of this cou..."}], "related_cwes": ["CWE-385", "CWE-352", "CWE-208"]}, "463": {"name": "Padding Oracle Crypto Attack", "abstraction": "Detailed", "status": "Draft", "description": "An adversary is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an adversary is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In...", "severity": "High", "prerequisites": ["The decryption routine does not properly authenticate the message / does not verify its integrity prior to performing the decryption operation", "The target system leaks data (in some way) on whether a padding error has occurred when attempting to decrypt the ciphertext.", "The padding oracle remains available for enough time / for as many requests as needed for the adversary to decrypt the ciphertext."], "examples": ["An adversary sends a request containing ciphertext to the target system. Due to the browser's same origin policy, the adversary is not able to see the response directly, but can use cross-domain information leak techniques to still get the information needed (i.e., information on whether or not a pa..."], "related_cwes": ["CWE-209", "CWE-514", "CWE-649", "CWE-347", "CWE-354", "CWE-696"]}, "464": {"name": "Evercookie", "abstraction": "Standard", "status": "Draft", "description": "An attacker creates a very persistent cookie that stays present even after the user thinks it has been removed. The cookie is stored on the victim's machine in over ten places. When the victim clears the cookie cache via traditional means inside the browser, that operation removes the cookie from certain places but not others. The malicious code then replicates the cookie from all of the places where it was not deleted to all of the possible storage locations once again. So the victim again has ...", "severity": "Medium", "prerequisites": ["The victim's browser is not configured to reject all cookiesThe victim visits a website that serves the attackers' evercookie"], "related_cwes": ["CWE-359"]}, "465": {"name": "Transparent Proxy Abuse", "abstraction": "Standard", "status": "Draft", "description": "A transparent proxy serves as an intermediate between the client and the internet at large. It intercepts all requests originating from the client and forwards them to the correct location. The proxy also intercepts all responses to the client and forwards these to the client. All of this is done in a manner transparent to the client.", "severity": "Medium", "prerequisites": ["Transparent proxy is usedVulnerable configuration of network topology involving the transparent proxy (e.g., no NAT happening between the client and the proxy)Execution of malicious Flash or Applet in..."], "related_cwes": ["CWE-441"]}, "466": {"name": "Leveraging Active Adversary in the Middle Attacks to Bypass Same Origin Policy", "abstraction": "Standard", "status": "Draft", "description": "An attacker leverages an adversary in the middle attack (CAPEC-94) in order to bypass the same origin policy protection in the victim's browser. This active adversary in the middle attack could be launched, for instance, when the victim is connected to a public WIFI hot spot. An attacker is able to intercept requests and responses between the victim's browser and some non-sensitive website that does not use TLS.", "severity": "Medium", "prerequisites": ["The victim and the attacker are both in an environment where an active adversary in the middle attack is possible (e.g., public WIFI hot spot)The victim visits at least one website that does not use T..."], "related_cwes": ["CWE-300"]}, "467": {"name": "Cross Site Identification", "abstraction": "Detailed", "status": "Draft", "description": "An attacker harvests identifying information about a victim via an active session that the victim's browser has with a social networking site. A victim may have the social networking site open in one tab or perhaps is simply using the \"remember me\" feature to keep their session with the social networking site active. An attacker induces a payload to execute in the victim's browser that transparently to the victim initiates a request to the social networking site (e.g., via available social netwo...", "severity": "Low", "prerequisites": ["The victim has an active session with the social networking site."], "examples": ["An attacker may post a malicious posting that contains an image with an embedded link. The link actually requests identifying information from the social networking site. A victim who views the malicious posting in their browser will have sent identifying information to the attacker, as long as the ..."], "related_cwes": ["CWE-352", "CWE-359"]}, "468": {"name": "Generic Cross-Browser Cross-Domain Theft", "abstraction": "Standard", "status": "Draft", "description": "An attacker makes use of Cascading Style Sheets (CSS) injection to steal data cross domain from the victim's browser. The attack works by abusing the standards relating to loading of CSS: 1. Send cookies on any load of CSS (including cross-domain) 2. When parsing returned CSS ignore all data that does not make sense before a valid CSS descriptor is found by the CSS parser.", "severity": "Medium", "prerequisites": ["No new lines can be present in the injected CSS stringProper HTML or URL escaping of the \" and ' characters is not presentThe attacker has control of two injection points: pre-string and post-string"], "related_cwes": ["CWE-707", "CWE-149", "CWE-177", "CWE-838"]}, "469": {"name": "HTTP DoS", "abstraction": "Standard", "status": "Draft", "description": "An attacker performs flooding at the HTTP level to bring down only a particular web application rather than anything listening on a TCP/IP connection. This denial of service attack requires substantially fewer packets to be sent which makes DoS harder to detect. This is an equivalent of SYN flood in HTTP. The idea is to keep the HTTP session alive indefinitely and then repeat that hundreds of times. This attack targets resource depletion weaknesses in web server software. The web server will wai...", "severity": "Low", "prerequisites": ["HTTP protocol is usedWeb server used is vulnerable to denial of service via HTTP flooding"], "related_cwes": ["CWE-770", "CWE-772"]}, "47": {"name": "Buffer Overflow via Parameter Expansion", "abstraction": "Detailed", "status": "Draft", "description": "In this attack, the target software is given input that the adversary knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow.", "likelihood": "Medium", "severity": "High", "prerequisites": ["The program expands one of the parameters passed to a function with input controlled by the user, but a later function making use of the expanded parameter erroneously considers the original, not the ...", "The expanded parameter is used in the context where buffer overflow may become possible due to the incorrect understanding of the parameter size (i.e. thinking that it is smaller than it really is)."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target application] The adversary identifies a target application or program to perform the buffer overflow on. Adversaries often look for applications that accept user input and that perfor..."}, {"step": "2", "phase": "Experiment", "description": "[Find injection vector] The adversary identifies an injection vector to deliver the excessive content to the targeted application's buffer."}, {"step": "3", "phase": "Experiment", "description": "[Craft overflow content] The adversary crafts the input to be given to the program. If the intent is to simply cause the software to crash, the input needs only to expand to an excessive quantity of r..."}, {"step": "4", "phase": "Exploit", "description": "[Overflow the buffer] Using the injection vector, the adversary gives the crafted input to the program, overflowing the buffer."}], "related_cwes": ["CWE-120", "CWE-119", "CWE-118", "CWE-130", "CWE-131", "CWE-74", "CWE-20", "CWE-680", "CWE-697"]}, "470": {"name": "Expanding Control over the Operating System from the Database", "abstraction": "Detailed", "status": "Draft", "description": "An attacker is able to leverage access gained to the database to read / write data to the file system, compromise the operating system, create a tunnel for accessing the host machine, and use this access to potentially attack other machines on the same network as the database machine. Traditionally SQL injections attacks are viewed as a way to gain unauthorized read access to the data stored in the database, modify the data in the database, delete the data, etc. However, almost every data base m...", "severity": "Very High", "prerequisites": ["A vulnerable DBMS is usedA SQL injection exists that gives an attacker access to the database or an attacker has access to the DBMS via other means"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "The adversary identifies a database management system running on a machine they would like to gain control over, or on a network they want to move laterally through."}, {"step": "2", "phase": "Experiment", "description": "The adversary goes about the typical steps of an SQL injection and determines if an injection is possible."}, {"step": "3", "phase": "Experiment", "description": "Once the Adversary determines that an SQL injection is possible, they must ensure that the requirements for the attack are met. These are a high privileged session user and batched query support. This..."}, {"step": "4", "phase": "Experiment", "description": "If the requirements are met, based on the database management system that is running, the adversary will find or create user defined functions (UDFs) that can be loaded as DLLs. An example of a DLL ca..."}, {"step": "5", "phase": "Experiment", "description": "In order to load the DLL, the adversary must first find the path to the plugin directory. The command to achieve this is different based on the type of DBMS, but for MySQL, this can be achieved by run..."}, {"step": "6", "phase": "Exploit", "description": "The DLL is then moved into the previously found plugin directory so that the contained functions can be loaded. This can be done in a number of ways; loading from a network share, writing the entire h..."}, {"step": "6", "phase": "Exploit", "description": "Once the DLL is in the plugin directory, a command is then run to load the UDFs. An example of this in MySQL is \"create function sys_eval returns string soname 'udf.dll';\" The function sys_eval is spe..."}, {"step": "6", "phase": "Exploit", "description": "Once the adversary has loaded the desired function(s), they will use these to execute arbitrary commands on the compromised system. This is done through a simple select command to the loaded UDF. For ..."}], "related_cwes": ["CWE-250", "CWE-89"]}, "471": {"name": "Search Order Hijacking", "abstraction": "Detailed", "status": "Stable", "description": "An adversary exploits a weakness in an application's specification of external libraries to exploit the functionality of the loader where the process loading the library searches first in the same directory in which the process binary resides and then in other directories. Exploitation of this preferential search order can allow an attacker to make the loading process load the adversary's rogue library rather than the legitimate library. This attack can be leveraged with many different libraries...", "severity": "Medium", "prerequisites": ["Attacker has a mechanism to place its malicious libraries in the needed location on the file system."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target general susceptibility] An attacker uses an automated tool or manually finds whether the target application uses dynamically linked libraries and the configuration file or look up tab..."}, {"step": "2", "phase": "Experiment", "description": "[Craft malicious libraries] The attacker uses knowledge gained in the Explore phase to craft malicious libraries that they will redirect the target to leverage. These malicious libraries could have th..."}, {"step": "3", "phase": "Exploit", "description": "[Redirect the access to libraries to the malicious libraries] The attacker redirects the target to the malicious libraries they crafted in the Experiment phase. The attacker will be able to force the ..."}], "examples": ["For instance, an attacker with access to the file system may place a malicious ntshrui.dll in the C:\\Windows directory. This DLL normally resides in the System32 folder. Process explorer.exe which also resides in C:\\Windows, upon trying to load the ntshrui.dll from the System32 folder will actually ...", "macOS and OS X use a common method to look for required dynamic libraries (dylib) to load into a program based on search paths. Adversaries can take advantage of ambiguous paths to plant dylibs to gain privilege escalation or persistence. A common method is to see what dylibs an application uses, th..."], "related_cwes": ["CWE-427"]}, "472": {"name": "Browser Fingerprinting", "abstraction": "Detailed", "status": "Draft", "description": "An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via J...", "severity": "Low", "prerequisites": ["Victim's browser visits a website that contains attacker's Java ScriptJava Script is not disabled in the victim's browser"], "related_cwes": ["CWE-200"]}, "473": {"name": "Signature Spoof", "abstraction": "Standard", "status": "Draft", "description": "An attacker generates a message or datablock that causes the recipient to believe that the message or datablock was generated and cryptographically signed by an authoritative or reputable source, misleading a victim or victim operating system into performing malicious actions.", "prerequisites": ["The victim or victim system is dependent upon a cryptographic signature-based verification system for validation of one or more security events or actions.", "The validation can be bypassed via an attacker-provided signature that makes it appear that the legitimate authoritative or reputable source provided the signature."], "examples": ["An attacker provides a victim with a malicious executable disguised as a legitimate executable from an established software by signing the executable with a forged cryptographic key. The victim's operating system attempts to verify the executable by checking the signature, the signature is considere...", "An attacker exploits weaknesses in a cryptographic algorithm to that allow a private key for a legitimate software vendor to be reconstructed, attacker-created malicious software is cryptographically signed with the reconstructed key, and is installed by the victim operating system disguised as a le..."], "related_cwes": ["CWE-20", "CWE-327", "CWE-290"]}, "474": {"name": "Signature Spoofing by Key Theft", "abstraction": "Detailed", "status": "Draft", "description": "An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.", "likelihood": "Medium", "severity": "High", "prerequisites": ["An authoritative or reputable signer is storing their private signature key with insufficient protection."], "related_cwes": ["CWE-522"]}, "475": {"name": "Signature Spoofing by Improper Validation", "abstraction": "Detailed", "status": "Draft", "description": "An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.", "likelihood": "Low", "severity": "High", "prerequisites": ["Recipient is using a weak cryptographic signature verification algorithm or a weak implementation of a cryptographic signature verification algorithm, or the configuration of the recipient's applicati..."], "examples": ["The Windows CryptoAPI (Crypt32.dll) was shown to be vulnerable to signature spoofing by failing to properly validate Elliptic Curve Cryptography (ECC) certificates. If the CryptoAPI's signature validator allows the specification of a nonstandard base point (G): \"An adversary can create a custom ECDS..."], "related_cwes": ["CWE-347", "CWE-327", "CWE-295"]}, "476": {"name": "Signature Spoofing by Misrepresentation", "abstraction": "Detailed", "status": "Draft", "description": "An attacker exploits a weakness in the parsing or display code of the recipient software to generate a data blob containing a supposedly valid signature, but the signer's identity is falsely represented, which can lead to the attacker manipulating the recipient software or its victim user to perform compromising actions.", "likelihood": "Low", "severity": "High", "prerequisites": ["Recipient is using signature verification software that does not clearly indicate potential homographs in the signer identity.Recipient is using signature verification software that contains a parsing..."], "related_cwes": ["CWE-290"]}, "477": {"name": "Signature Spoofing by Mixing Signed and Unsigned Content", "abstraction": "Detailed", "status": "Draft", "description": "An attacker exploits the underlying complexity of a data structure that allows for both signed and unsigned content, to cause unsigned data to be processed as though it were signed data.", "likelihood": "Low", "severity": "High", "prerequisites": ["Signer and recipient are using complex data storage structures that allow for a mix between signed and unsigned data", "Recipient is using signature verification software that does not maintain separation between signed and unsigned data once the signature has been verified."], "related_cwes": ["CWE-693", "CWE-311", "CWE-319"]}, "478": {"name": "Modification of Windows Service Configuration", "abstraction": "Detailed", "status": "Usable", "description": "An adversary exploits a weakness in access control to modify the execution parameters of a Windows service. The goal of this attack is to execute a malicious binary in place of an existing service.", "likelihood": "Low", "severity": "High", "prerequisites": ["The adversary must have the capability to write to the Windows Registry on the targeted system."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine target system] The adversary must first determine the system they wish to modify the registry of. This needs to be a windows machine as this attack only works on the windows registry."}, {"step": "2", "phase": "Experiment", "description": "[Gain access to the system] The adversary needs to gain access to the system in some way so that they can modify the windows registry."}, {"step": "3", "phase": "Exploit", "description": "[Modify windows registry] The adversary will modify the windows registry by changing the configuration settings for a service. Specifically, the adversary will change the path settings to define a pat..."}], "related_cwes": ["CWE-284"]}, "479": {"name": "Malicious Root Certificate", "abstraction": "Detailed", "status": "Stable", "description": "An adversary exploits a weakness in authorization and installs a new root certificate on a compromised system. Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website. Adversaries h...", "likelihood": "Low", "severity": "Low", "prerequisites": ["The adversary must have the ability to create a new root certificate."], "related_cwes": ["CWE-284"]}, "48": {"name": "Passing Local Filenames to Functions That Expect a URL", "abstraction": "Standard", "status": "Draft", "description": "This attack relies on client side code to access local files and resources instead of URLs. When the client browser is expecting a URL string, but instead receives a request for a local file, that execution is likely to occur in the browser process space with the browser's authority to local files. The attacker can send the results of this request to the local files out to a site that they control. This attack may be used to steal sensitive authentication data (either local or remote), or to gai...", "likelihood": "High", "severity": "High", "prerequisites": ["The victim's software must not differentiate between the location and type of reference passed the client software, e.g. browser"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify web application URL inputs] Review application inputs to find those that are designed to be URLs."}, {"step": "2", "phase": "Experiment", "description": "[Identify URL inputs allowing local access.] Execute test local commands via each URL input to determine which are successful."}, {"step": "3", "phase": "Exploit", "description": "[Execute malicious commands] Using the identified URL inputs that allow local command execution, execute malicious commands."}], "related_cwes": ["CWE-241", "CWE-706"]}, "480": {"name": "Escaping Virtualization", "abstraction": "Standard", "status": "Draft", "description": "An adversary gains access to an application, service, or device with the privileges of an authorized or privileged user by escaping the confines of a virtualized environment. The adversary is then able to access resources or execute unauthorized code within the host environment, generally with the privileges of the user running the virtualized process. Successfully executing an attack of this type is often the first step in executing more complex attacks.", "likelihood": "Low", "severity": "Very High", "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Probing] The adversary probes the target application, service, or device to find a possible weakness that would allow escaping the virtualized environment."}, {"step": "2", "phase": "Experiment", "description": "[Verify the exploitable security weaknesses] Using the found weakness, the adversary attempts to escape the virtualized environment."}, {"step": "3", "phase": "Exploit", "description": "[Execute more complex attacks] Once outside of the virtualized environment, the adversary attempts to perform other more complex attacks such as accessing system resources or executing unauthorized co..."}], "related_cwes": ["CWE-693"]}, "481": {"name": "Contradictory Destinations in Traffic Routing Schemes", "abstraction": "Standard", "status": "Draft", "description": "Adversaries can provide contradictory destinations when sending messages. Traffic is routed in networks using the domain names in various headers available at different levels of the OSI model. In a Content Delivery Network (CDN) multiple domains might be available, and if there are contradictory domain names provided it is possible to route traffic to an inappropriate destination. The technique, called Domain Fronting, involves using different domain names in the SNI field of the TLS header and...", "likelihood": "Medium", "severity": "High", "prerequisites": ["An adversary must be aware that their message will be routed using a CDN, and that both of the contradictory domains are served from that CDN.", "If the purpose of the Domain Fronting is to hide redirected C2 traffic, the C2 server must have been created in the CDN."], "related_cwes": ["CWE-923"]}, "482": {"name": "TCP Flood", "abstraction": "Standard", "status": "Draft", "description": "An adversary may execute a flooding attack using the TCP protocol with the intent to deny legitimate users access to a service. These attacks exploit the weakness within the TCP protocol where there is some state information for the connection the server needs to maintain. This often involves the use of TCP SYN messages.", "prerequisites": ["This type of an attack requires the ability to generate a large amount of TCP traffic to send to the target port of a functioning server."], "related_cwes": ["CWE-770"]}, "484": {"name": "DEPRECATED: XML Client-Side Attack", "abstraction": "Standard", "status": "Deprecated", "description": "This attack pattern has been deprecated as it a generalization of CAPEC-230: XML Nested Payloads and CAPEC-231: XML Oversized Payloads. Please refer to these CAPECs going forward."}, "485": {"name": "Signature Spoofing by Key Recreation", "abstraction": "Detailed", "status": "Draft", "description": "An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.", "likelihood": "Low", "severity": "High", "prerequisites": ["An authoritative signer is using a weak method of random number generation or weak signing software that causes key leakage or permits key inference.", "An authoritative signer is using a signature algorithm with a direct weakness or with poorly chosen parameters that enable the key to be recovered using signatures from that signer."], "related_cwes": ["CWE-330"]}, "486": {"name": "UDP Flood", "abstraction": "Standard", "status": "Draft", "description": "An adversary may execute a flooding attack using the UDP protocol with the intent to deny legitimate users access to a service by consuming the available network bandwidth. Additionally, firewalls often open a port for each UDP connection destined for a service with an open UDP port, meaning the firewalls in essence save the connection state thus the high packet nature of a UDP flood can also overwhelm resources allocated to the firewall. UDP attacks can also target services like DNS or VoIP whi...", "prerequisites": ["This type of an attack requires the ability to generate a large amount of UDP traffic to send to the desired port of a target service using UDP."], "related_cwes": ["CWE-770"]}, "487": {"name": "ICMP Flood", "abstraction": "Standard", "status": "Draft", "description": "An adversary may execute a flooding attack using the ICMP protocol with the intent to deny legitimate users access to a service by consuming the available network bandwidth. A typical attack involves a victim server receiving ICMP packets at a high rate from a wide range of source addresses. Additionally, due to the session-less nature of the ICMP protocol, the source of a packet is easily spoofed making it difficult to find the source of the attack.", "prerequisites": ["This type of an attack requires the ability to generate a large amount of ICMP traffic to send to the target server."], "related_cwes": ["CWE-770"]}, "488": {"name": "HTTP Flood", "abstraction": "Standard", "status": "Draft", "description": "An adversary may execute a flooding attack using the HTTP protocol with the intent to deny legitimate users access to a service by consuming resources at the application layer such as web services and their infrastructure. These attacks use legitimate session-based HTTP GET requests designed to consume large amounts of a server's resources. Since these are legitimate sessions this attack is very difficult to detect.", "prerequisites": ["This type of an attack requires the ability to generate a large amount of HTTP traffic to send to a target server."], "related_cwes": ["CWE-770"]}, "489": {"name": "SSL Flood", "abstraction": "Standard", "status": "Draft", "description": "An adversary may execute a flooding attack using the SSL protocol with the intent to deny legitimate users access to a service by consuming all the available resources on the server side. These attacks take advantage of the asymmetric relationship between the processing power used by the client and the processing power used by the server to create a secure connection. In this manner the attacker can make a large number of HTTPS requests on a low provisioned machine to tie up a disproportionately...", "prerequisites": ["This type of an attack requires the ability to generate a large amount of SSL traffic to send a target server."], "related_cwes": ["CWE-770"]}, "49": {"name": "Password Brute Forcing", "abstraction": "Standard", "status": "Draft", "description": "An adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password.", "likelihood": "Medium", "severity": "High", "prerequisites": ["An adversary needs to know a username to target.", "The system uses password based authentication as the one factor authentication mechanism.", "An application does not have a password throttling mechanism in place. A good password throttling mechanism will make it almost impossible computationally to brute force a password as it may either lo..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine application's/system's password policy] Determine the password policies of the target application/system."}, {"step": "2", "phase": "Exploit", "description": "[Brute force password] Given the finite space of possible passwords dictated by the password policy determined in the previous step, try all possible passwords for a known user ID until application/sy..."}], "examples": ["A weakness exists in the automatic password generation routine of Mailman prior to 2.1.5 that causes only about five million different passwords to be generated. This makes it easy to brute force the password for all users who decided to let Mailman automatically generate their passwords for them. U..."], "related_cwes": ["CWE-521", "CWE-262", "CWE-263", "CWE-257", "CWE-654", "CWE-307", "CWE-308", "CWE-309"]}, "490": {"name": "Amplification", "abstraction": "Standard", "status": "Draft", "description": "An adversary may execute an amplification where the size of a response is far greater than that of the request that generates it. The goal of this attack is to use a relatively few resources to create a large amount of traffic against a target server. To execute this attack, an adversary send a request to a 3rd party service, spoofing the source address to be that of the target server. The larger response that is generated by the 3rd party service is then sent to the target server. By sending a ...", "prerequisites": ["This type of an attack requires the existence of a 3rd party service that generates a response that is significantly larger than the request that triggers it."], "related_cwes": ["CWE-770"]}, "491": {"name": "Quadratic Data Expansion", "abstraction": "Detailed", "status": "Draft", "description": "An adversary exploits macro-like substitution to cause a denial of service situation due to excessive memory being allocated to fully expand the data. The result of this denial of service could cause the application to freeze or crash. This involves defining a very large entity and using it multiple times in a single entity substitution. CAPEC-197 is a similar attack pattern, but it is easier to discover and defend against. This attack pattern does not perform multi-level substitution and theref...", "prerequisites": ["This type of attack requires a server that accepts serialization data which supports substitution and parses the data."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the target] An adversary determines the input data stream that is being processed by a data parser that supports using substituion on the victim's side."}, {"step": "2", "phase": "Exploit", "description": "[Craft malicious payload] The adversary crafts malicious message containing nested quadratic expansion that completely uses up available server resource."}, {"step": "3", "phase": "Exploit", "description": "[Send the message] Send the malicious crafted message to the target URL."}], "related_cwes": ["CWE-770"]}, "492": {"name": "Regular Expression Exponential Blowup", "abstraction": "Standard", "status": "Draft", "description": "An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.", "prerequisites": ["This type of an attack requires the ability to identify hosts running a poorly implemented Regex, and the ability to send crafted input to exploit the regular expression."], "related_cwes": ["CWE-400", "CWE-1333"]}, "493": {"name": "SOAP Array Blowup", "abstraction": "Standard", "status": "Draft", "description": "An adversary may execute an attack on a web service that uses SOAP messages in communication. By sending a very large SOAP array declaration to the web service, the attacker forces the web service to allocate space for the array elements before they are parsed by the XML parser. The attacker message is typically small in size containing a large array declaration of say 1,000,000 elements and a couple of array elements. This attack targets exhaustion of the memory resources of the web service.", "prerequisites": ["This type of an attack requires the attacker to know the endpoint of the web service, and be able to reach the endpoint with a malicious SOAP message."], "related_cwes": ["CWE-770"]}, "494": {"name": "TCP Fragmentation", "abstraction": "Standard", "status": "Draft", "description": "An adversary may execute a TCP Fragmentation attack against a target with the intention of avoiding filtering rules of network controls, by attempting to fragment the TCP packet such that the headers flag field is pushed into the second fragment which typically is not filtered.", "prerequisites": ["This type of an attack requires the target system to be running a vulnerable implementation of IP, and the adversary needs to ability to send TCP packets of arbitrary size with crafted data."], "related_cwes": ["CWE-770", "CWE-404"]}, "495": {"name": "UDP Fragmentation", "abstraction": "Standard", "status": "Draft", "description": "An attacker may execute a UDP Fragmentation attack against a target server in an attempt to consume resources such as bandwidth and CPU. IP fragmentation occurs when an IP datagram is larger than the MTU of the route the datagram has to traverse. Typically the attacker will use large UDP packets over 1500 bytes of data which forces fragmentation as ethernet MTU is 1500 bytes. This attack is a variation on a typical UDP flood but it enables more network bandwidth to be consumed with fewer packets...", "prerequisites": ["This type of an attack requires the attacker to be able to generate fragmented IP traffic containing crafted data."], "related_cwes": ["CWE-770", "CWE-404"]}, "496": {"name": "ICMP Fragmentation", "abstraction": "Standard", "status": "Draft", "description": "An attacker may execute a ICMP Fragmentation attack against a target with the intention of consuming resources or causing a crash. The attacker crafts a large number of identical fragmented IP packets containing a portion of a fragmented ICMP message. The attacker these sends these messages to a target host which causes the host to become non-responsive. Another vector may be sending a fragmented ICMP message to a target host with incorrect sizes in the header which causes the host to hang.", "prerequisites": ["This type of an attack requires the target system to be running a vulnerable implementation of IP, and the attacker needs to ability to send arbitrary sized ICMP packets to the target."], "related_cwes": ["CWE-770", "CWE-404"]}, "497": {"name": "File Discovery", "abstraction": "Standard", "status": "Draft", "description": "An adversary engages in probing and exploration activities to determine if common key files exists. Such files often contain configuration and security parameters of the targeted application, system or network. Using this knowledge may often pave the way for more damaging attacks.", "likelihood": "High", "severity": "Very Low", "prerequisites": ["The adversary must know the location of these common key files."], "related_cwes": ["CWE-200"]}, "498": {"name": "Probe iOS Screenshots", "abstraction": "Detailed", "status": "Draft", "description": "An adversary examines screenshot images created by iOS in an attempt to obtain sensitive information. This attack targets temporary screenshots created by the underlying OS while the application remains open in the background.", "prerequisites": ["This type of an attack requires physical access to a device to either excavate the image files (potentially by leveraging a Jailbreak) or view the screenshots through the multitasking switcher (by dou..."], "related_cwes": ["CWE-359"]}, "499": {"name": "Android Intent Intercept", "abstraction": "Standard", "status": "Draft", "description": "An adversary, through a previously installed malicious application, intercepts messages from a trusted Android-based application in an attempt to achieve a variety of different objectives including denial of service, information disclosure, and data injection. An implicit intent sent from a trusted application can be received by any application that has declared an appropriate intent filter. If the intent is not protected by a permission that the malicious application lacks, then the attacker ca...", "prerequisites": ["An adversary must be able install a purpose built malicious application onto the Android device and convince the user to execute it. The malicious application is used to intercept implicit intents."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find an android application that uses implicit intents] Since this attack only works on android applications that use implicit intents, rather than explicit intents, an adversary must first identify ..."}, {"step": "2", "phase": "Experiment", "description": "[Create a malicious app] The adversary must create a malicious android app meant to intercept implicit intents from a target application"}, {"step": "3", "phase": "Experiment", "description": "[Get user to download malicious app] The adversary must get a user using the targeted app to download the malicious app by any means necessary"}, {"step": "4", "phase": "Exploit", "description": "[Intercept Implicit Intents] Once the malicious app is downloaded, the android device will forward any implicit intents from the target application to the malicious application, allowing the adversary..."}], "related_cwes": ["CWE-925"]}, "5": {"name": "Blue Boxing", "abstraction": "Detailed", "status": "Obsolete", "likelihood": "Medium", "severity": "Very High", "prerequisites": ["System must use weak authentication mechanisms for administrative functions."], "examples": ["An adversary identifies a vulnerable CCITT-5 phone line, and sends a combination tone to the switch in order to request administrative access. Based on tone and timing parameters the request is verified for access to the switch. Once the adversary has gained control of the switch launching calls, ro..."], "related_cwes": ["CWE-285"]}, "50": {"name": "Password Recovery Exploitation", "abstraction": "Standard", "status": "Draft", "description": "An attacker may take advantage of the application feature to help users recover their forgotten passwords in order to gain access into the system with the same privileges as the original user. Generally password recovery schemes tend to be weak and insecure.", "likelihood": "Medium", "severity": "High", "prerequisites": ["The system allows users to recover their passwords and gain access back into the system.", "Password recovery mechanism has been designed or implemented insecurely.", "Password recovery mechanism relies only on something the user knows and not something the user has.", "No third party intervention is required to use the password recovery mechanism."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "Understand the password recovery mechanism and how it works."}, {"step": "2", "phase": "Exploit", "description": "Find a weakness in the password recovery mechanism and exploit it. For instance, a weakness may be that a standard single security question is used with an easy to determine answer."}], "examples": ["An attacker clicks on the \"forgot password\" and is presented with a single security question. The question is regarding the name of the first dog of the user. The system does not limit the number of attempts to provide the dog's name. An attacker goes through a list of 100 most popular dog names and..."], "related_cwes": ["CWE-522", "CWE-640"]}, "500": {"name": "WebView Injection", "abstraction": "Detailed", "status": "Draft", "description": "An adversary, through a previously installed malicious application, injects code into the context of a web page displayed by a WebView component. Through the injected code, an adversary is able to manipulate the DOM tree and cookies of the page, expose sensitive information, and can launch attacks against the web application from within the web page.", "prerequisites": ["An adversary must be able install a purpose built malicious application onto the device and convince the user to execute it. The malicious application is designed to target a specific web application ..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine target web application] An adversary first needs to determine what web application they wish to target."}, {"step": "2", "phase": "Experiment", "description": "[Create malicious application] An adversary creates an application, often mobile, that incorporates a WebView component to display the targeted web application. This malicious application needs to dow..."}, {"step": "3", "phase": "Experiment", "description": "[Get the victim to download and run the application] An adversary needs to get the victim to willingly download and run the application."}, {"step": "4", "phase": "Exploit", "description": "[Inject malicious code] Once the victim runs the malicious application and views the targeted web page in the WebView component, the malicious application will inject malicious JavaScript code into th..."}], "related_cwes": ["CWE-749", "CWE-940"]}, "501": {"name": "Android Activity Hijack", "abstraction": "Detailed", "status": "Draft", "description": "An adversary intercepts an implicit intent sent to launch a Android-based trusted activity and instead launches a counterfeit activity in its place. The malicious activity is then used to mimic the trusted activity's user interface and prompt the target to enter sensitive data as if they were interacting with the trusted activity.", "severity": "Medium", "prerequisites": ["The adversary must have previously installed the malicious application onto the Android device that will run in place of the trusted activity."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find an android application that uses implicit intents] Since this attack only works on android applications that use implicit intents, rather than explicit intents, an adversary must first identify ..."}, {"step": "2", "phase": "Experiment", "description": "[Create a malicious app] The adversary must create a malicious android app meant to intercept implicit intents to launch an Adroid-based trusted activity. This malicious app will mimic the trusted act..."}, {"step": "3", "phase": "Experiment", "description": "[Get user to download malicious app] The adversary must get a user using the targeted app to download the malicious app by any means necessary"}, {"step": "4", "phase": "Exploit", "description": "[Gather sensitive data through malicious app] Once the target application sends an implicit intent to launch a trusted activity, the malicious app will be launched instead that looks identical to the ..."}], "related_cwes": ["CWE-923"]}, "502": {"name": "Intent Spoof", "abstraction": "Standard", "status": "Draft", "description": "An adversary, through a previously installed malicious application, issues an intent directed toward a specific trusted application's component in an attempt to achieve a variety of different objectives including modification of data, information disclosure, and data injection. Components that have been unintentionally exported and made public are subject to this type of an attack. If the component trusts the intent's action without verififcation, then the target application performs the functio...", "prerequisites": ["An adversary must be able install a purpose built malicious application onto the Android device and convince the user to execute it. The malicious application will be used to issue spoofed intents."], "related_cwes": ["CWE-284"]}, "503": {"name": "WebView Exposure", "abstraction": "Standard", "status": "Draft", "description": "An adversary, through a malicious web page, accesses application specific functionality by leveraging interfaces registered through WebView's addJavascriptInterface API. Once an interface is registered to WebView through addJavascriptInterface, it becomes global and all pages loaded in the WebView can call this interface.", "prerequisites": ["This type of an attack requires the adversary to convince the user to load the malicious web page inside the target application. Once loaded, the malicious web page will have the same permissions as t..."], "related_cwes": ["CWE-284"]}, "504": {"name": "Task Impersonation", "abstraction": "Standard", "status": "Stable", "description": "An adversary, through a previously installed malicious application, impersonates an expected or routine task in an attempt to steal sensitive information or leverage a user's privileges.", "likelihood": "Medium", "severity": "High", "prerequisites": ["The adversary must already have access to the target system via some means.", "A legitimate task must exist that an adversary can impersonate to glean credentials.", "The user's privileges allow them to execute certain tasks with elevated privileges."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine suitable tasks to exploit] Determine what tasks exist on the target system that may result in a user providing sensitive information."}, {"step": "2", "phase": "Exploit", "description": "[Impersonate Task] Impersonate a legitimate task, either expected or unexpected, in an attempt to gain user credentials or to ride the user's privileges."}], "examples": ["An adversary monitors the system task list for Microsoft Outlook in an attempt to determine when the application may prompt the user to enter their credentials to view encrypted email. Once the task is executed, the adversary impersonates the credential prompt to obtain the user's Microsoft Outlook ...", "An adversary prompts a user to authorize an elevation of privileges, implying that a background task needs additional permissions to execute. The user accepts the privilege elevation, allowing the adversary to execute additional malware or tasks with the user's privileges."], "related_cwes": ["CWE-1021"]}, "505": {"name": "Scheme Squatting", "abstraction": "Detailed", "status": "Draft", "description": "An adversary, through a previously installed malicious application, registers for a URL scheme intended for a target application that has not been installed. Thereafter, messages intended for the target application are handled by the malicious application. Upon receiving a message, the malicious application displays a screen that mimics the target application, thereby convincing the user to enter sensitive information. This type of attack is most often used to obtain sensitive information (e.g.,..."}, "506": {"name": "Tapjacking", "abstraction": "Standard", "status": "Draft", "description": "An adversary, through a previously installed malicious application, displays an interface that misleads the user and convinces them to tap on an attacker desired location on the screen. This is often accomplished by overlaying one screen on top of another while giving the appearance of a single interface. There are two main techniques used to accomplish this. The first is to leverage transparent properties that allow taps on the screen to pass through the visible application to an application ru...", "likelihood": "Low", "severity": "Low", "prerequisites": ["This pattern of attack requires the ability to execute a malicious application on the user's device. This malicious application is used to present the interface to the user and make the attack possibl..."], "related_cwes": ["CWE-1021"]}, "507": {"name": "Physical Theft", "abstraction": "Meta", "status": "Draft", "description": "An adversary gains physical access to a system or device through theft of the item. Possession of a system or device enables a number of unique attacks to be executed and often provides the adversary with an extended timeframe for which to perform an attack. Most protections put in place to secure sensitive information can be defeated when an adversary has physical access and enough time.", "prerequisites": ["This type of attack requires the existence of a physical target that an adversary believes hosts something of value."]}, "508": {"name": "Shoulder Surfing", "abstraction": "Detailed", "status": "Draft", "description": "In a shoulder surfing attack, an adversary observes an unaware individual's keystrokes, screen content, or conversations with the goal of obtaining sensitive information. One motive for this attack is to obtain sensitive information about the target for financial, personal, political, or other gains. From an insider threat perspective, an additional motive could be to obtain system/application credentials or cryptographic keys. Shoulder surfing attacks are accomplished by observing the content \"...", "likelihood": "High", "severity": "High", "prerequisites": ["The adversary typically requires physical proximity to the target's environment, in order to observe their screen or conversation. This may not be the case if the adversary is able to record the targe..."], "examples": ["An adversary can capture a target's banking credentials and transfer money to adversary-controlled accounts.", "An adversary observes the target's mobile device lock screen pattern/passcode and then steals the device, which can now be unlocked.", "An insider could obtain database credentials for an application and sell the credentials on the black market."], "related_cwes": ["CWE-200", "CWE-359"]}, "509": {"name": "Kerberoasting", "abstraction": "Detailed", "status": "Stable", "description": "Through the exploitation of how service accounts leverage Kerberos authentication with Service Principal Names (SPNs), the adversary obtains and subsequently cracks the hashed credentials of a service account target to exploit its privileges. The Kerberos authentication protocol centers around a ticketing system which is used to request/grant access to services and to then access the requested services. As an authenticated user, the adversary may request Active Directory and obtain a service tic...", "severity": "High", "prerequisites": ["The adversary requires access as an authenticated user on the system. This attack pattern relates to elevating privileges.", "The adversary requires use of a third-party credential harvesting tool (e.g., Mimikatz).", "The adversary requires a brute force tool."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "Scan for user accounts with set SPN values"}, {"step": "2", "phase": "Explore", "description": "Request service tickets"}, {"step": "3", "phase": "Experiment", "description": "Extract ticket and save to disk"}, {"step": "4", "phase": "Exploit", "description": "Crack the encrypted ticket to harvest plain text credentials"}], "examples": ["PowerSploit's Invoke-Kerberoast module can be leveraged to request Ticket Granting Service (TGS) tickets and return crackable ticket hashes. [REF-585] [REF-586]"], "related_cwes": ["CWE-522", "CWE-308", "CWE-309", "CWE-294", "CWE-263", "CWE-262", "CWE-521"]}, "51": {"name": "Poison Web Service Registry", "abstraction": "Detailed", "status": "Draft", "description": "SOA and Web Services often use a registry to perform look up, get schema information, and metadata about services. A poisoned registry can redirect (think phishing for servers) the service requester to a malicious service provider, provide incorrect information in schema or metadata, and delete information about service provider interfaces.", "likelihood": "High", "severity": "Very High", "prerequisites": ["The attacker must be able to write to resources or redirect access to the service registry."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find a target SOA or Web Service] The adversary must first indentify a target SOA or Web Service."}, {"step": "2", "phase": "Experiment", "description": "[Determine desired outcome] Because poisoning a web service registry can have different outcomes, the adversary must decide how they wish to effect the webservice."}, {"step": "3", "phase": "Experiment", "description": "[Determine if a malicious service needs to be created] If the adversary wishes to redirect requests or responses, they will need to create a malicious service to redirect to."}, {"step": "4", "phase": "Exploit", "description": "[Poison Web Service Registry] Based on the desired outcome, poison the web service registry. This is done by altering the data at rest in the registry or uploading malicious content by spoofing a serv..."}], "related_cwes": ["CWE-285", "CWE-74", "CWE-693"]}, "510": {"name": "SaaS User Request Forgery", "abstraction": "Standard", "status": "Draft", "description": "An adversary, through a previously installed malicious application, performs malicious actions against a third-party Software as a Service (SaaS) application (also known as a cloud based application) by leveraging the persistent and implicit trust placed on a trusted user's session. This attack is executed after a trusted user is authenticated into a cloud service, \"piggy-backing\" on the authenticated session, and exploiting the fact that the cloud service believes it is only interacting with th...", "likelihood": "High", "severity": "Medium", "prerequisites": ["An adversary must be able install a purpose built malicious application onto the trusted user's system and convince the user to execute it while authenticated to the SaaS application."], "related_cwes": ["CWE-346"]}, "511": {"name": "Infiltration of Software Development Environment", "abstraction": "Detailed", "status": "Draft", "description": "An attacker uses common delivery mechanisms such as email attachments or removable media to infiltrate the IDE (Integrated Development Environment) of a victim manufacturer with the intent of implanting malware allowing for attack control of the victim IDE environment. The attack then uses this access to exfiltrate sensitive data or information, manipulate said data or information, and conceal these actions. This will allow and aid the attack to meet the goal of future compromise of a recipient ...", "likelihood": "Low", "severity": "High", "prerequisites": ["The victim must use email or removable media from systems running the IDE (or systems adjacent to the IDE systems).", "The victim must have a system running exploitable applications and/or a vulnerable configuration to allow for initial infiltration.", "The attacker must have working knowledge of some if not all of the components involved in the IDE system as well as the infrastructure."], "examples": ["The attacker, knowing the victim runs email on a system adjacent to the IDE system, sends a phishing email with a malicious attachment to the victim. When viewed, the malicious attachment installs a backdoor that allows the attacker to remotely compromise the adjacent IDE system from the victim's wo...", "Using rogue versions of Xcode (Apple's app development tool) downloaded from third-party websites, it was possible for the adversary to insert malicious code into legitimate apps during the development process."]}, "516": {"name": "Hardware Component Substitution During Baselining", "abstraction": "Detailed", "status": "Draft", "description": "An adversary with access to system components during allocated baseline development can substitute a maliciously altered hardware component for a baseline component during the product development and research phases. This can lead to adjustments and calibrations being made in the product so that when the final product, now containing the modified component, is deployed it will not perform as designed and be advantageous to the adversary.", "likelihood": "Low", "severity": "High", "prerequisites": ["The adversary will need either physical access or be able to supply malicious hardware components to the product development facility."]}, "517": {"name": "Documentation Alteration to Circumvent Dial-down", "abstraction": "Detailed", "status": "Draft", "description": "An attacker with access to a manufacturer's documentation, which include descriptions of advanced technology and/or specific components' criticality, alters the documents to circumvent dial-down functionality requirements. This alteration would change the interpretation of implementation and manufacturing techniques, allowing for advanced technologies to remain in place even though these technologies might be restricted to certain customers, such as nations on the terrorist watch list, giving th...", "likelihood": "Low", "severity": "High", "prerequisites": ["Advanced knowledge of internal software and hardware components within manufacturer's development environment.", "Access to the manufacturer's documentation."], "examples": ["A product for manufacture exists that contains advanced cryptographic capabilities, including algorithms that are restricted from being shipped to some nations. An attacker from one of the restricted nations alters the documentation to ensure that when the product is manufactured for shipment to a r..."]}, "518": {"name": "Documentation Alteration to Produce Under-performing Systems", "abstraction": "Detailed", "status": "Draft", "description": "An attacker with access to a manufacturer's documentation alters the descriptions of system capabilities with the intent of causing errors in derived system requirements, impacting the overall effectiveness and capability of the system, allowing an attacker to take advantage of the introduced system capability flaw once the system is deployed.", "likelihood": "Low", "severity": "High", "prerequisites": ["Advanced knowledge of software and hardware capabilities of a manufacturer's product.", "Access to the manufacturer's documentation."], "examples": ["A security subsystem involving encryption is a part of a product, but due to the demands of this subsystem during operation, the subsystem only runs when a specific amount of memory and processing is available. An attacker alters the descriptions of the system capabilities so that when deployed with..."]}, "519": {"name": "Documentation Alteration to Cause Errors in System Design", "abstraction": "Detailed", "status": "Draft", "description": "An attacker with access to a manufacturer's documentation containing requirements allocation and software design processes maliciously alters the documentation in order to cause errors in system design. This allows the attacker to take advantage of a weakness in a deployed system of the manufacturer for malicious purposes.", "likelihood": "Low", "severity": "High", "prerequisites": ["Advanced knowledge of software capabilities of a manufacturer's product.", "Access to the manufacturer's documentation."], "examples": ["During operation, a firewall will restart various subsystems to reload and implement new rules as added by the user. An attacker alters the software design dependencies in the manufacturer's documentation so that under certain predictable conditions the reload will fail to load in rules resulting in..."]}, "52": {"name": "Embedding NULL Bytes", "abstraction": "Detailed", "status": "Draft", "description": "An adversary embeds one or more null bytes in input to the target software. This attack relies on the usage of a null-valued byte as a string terminator in many environments. The goal is for certain components of the target software to stop processing the input when it encounters the null byte(s).", "likelihood": "High", "severity": "High", "prerequisites": ["The program does not properly handle postfix NULL terminators"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application."}, {"step": "2", "phase": "Experiment", "description": "[Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and injects postfix null byte(s) to observe how the application hand..."}, {"step": "3", "phase": "Exploit", "description": "[Remove data after null byte(s)] After determined entry points that are vulnerable, the adversary places a null byte(s) such that they remove data after the null byte(s) in a way that is beneficial to..."}], "related_cwes": ["CWE-158", "CWE-172", "CWE-173", "CWE-74", "CWE-20", "CWE-697", "CWE-707"]}, "520": {"name": "Counterfeit Hardware Component Inserted During Product Assembly", "abstraction": "Detailed", "status": "Draft", "description": "An adversary with either direct access to the product assembly process or to the supply of subcomponents used in the product assembly process introduces counterfeit hardware components into product assembly. The assembly containing the counterfeit components results in a system specifically designed for malicious purposes.", "likelihood": "Low", "severity": "High", "prerequisites": ["The adversary will need either physical access or be able to supply malicious hardware components to the product development facility."]}, "521": {"name": "Hardware Design Specifications Are Altered", "abstraction": "Detailed", "status": "Draft", "description": "An attacker with access to a manufacturer's hardware manufacturing process documentation alters the design specifications, which introduces flaws advantageous to the attacker once the system is deployed.", "likelihood": "Low", "severity": "High", "prerequisites": ["Advanced knowledge of hardware capabilities of a manufacturer's product.", "Access to the manufacturer's documentation."], "examples": ["To operate at full capability, a manufacturer's network intrusion detection device needs to have either a Intel Xeon E7-2820 or AMD FX-8350 which have 8 \"cores\" available, allowing for advanced threading needed to handle large volumes of network traffic without resorting to dropping packets from the..."]}, "522": {"name": "Malicious Hardware Component Replacement", "abstraction": "Standard", "status": "Draft", "description": "An adversary replaces legitimate hardware in the system with faulty counterfeit or tampered hardware in the supply chain distribution channel, with purpose of causing malicious disruption or allowing for additional compromise when the system is deployed.", "likelihood": "Low", "severity": "High", "prerequisites": ["Physical access to the system after it has left the manufacturer but before it is deployed at the victim location."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine Target Hardware] The adversary must first identify a system that they wish to target, and a specific hardware component that they can swap out with a malicious replacement."}, {"step": "2", "phase": "Explore", "description": "[Discover Vulnerability in Supply Chain] The adversary maps out the supply chain for the targeted system. They look for ooportunities to gain physical access to the system after it has left the manufa..."}, {"step": "3", "phase": "Experiment", "description": "[Test a Malicious Component Replacement] Before performing the attack in the wild, an adversary will test the attack on a system they have procured to ensure that the desired outcome will be achieved."}, {"step": "3", "phase": "Exploit", "description": "[Substitute Components in the Supply Chain] Using the vulnerability in the supply chain of the system discovered in the explore phase, the adversary substitutes the malicious component for the targete..."}], "examples": ["During shipment the adversary is able to intercept a system that has been purchased by the victim, and replaces a math processor card that functions just like the original, but contains advanced malicious capability. Once deployed, the system functions as normal, but allows for the adversary to remo..."]}, "523": {"name": "Malicious Software Implanted", "abstraction": "Standard", "status": "Draft", "description": "An attacker implants malicious software into the system in the supply chain distribution channel, with purpose of causing malicious disruption or allowing for additional compromise when the system is deployed.", "likelihood": "Low", "severity": "High", "prerequisites": ["Physical access to the system after it has left the manufacturer but before it is deployed at the victim location."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine Entry Point] The adversary must first identify a system that they wish to target and search for an entry point they can use to install the malicious software. This could be a system which t..."}, {"step": "2", "phase": "Explore", "description": "[Discover Vulnerability in Supply Chain] The adversary maps out the supply chain for the targeted system. They look for ooportunities to gain physical access to the system after it has left the manufa..."}, {"step": "3", "phase": "Experiment", "description": "[Test Malicious Software] Before performing the attack in the wild, an adversary will test the attack on a system they have procured to ensure that the desired outcome will be achieved."}, {"step": "4", "phase": "Exploit", "description": "[Implant Software in the Supply Chain] Using the vulnerability in the supply chain of the system discovered in the explore phase, the adversary implants the malicious software into the system. This re..."}], "examples": ["An attacker has created a piece of malicious software designed to function as a backdoor in a system that is to be deployed at the victim location. During shipment of the system, the attacker has physical access to the system at a loading dock of an integrator for a short time. The attacker unpacks ..."]}, "524": {"name": "Rogue Integration Procedures", "abstraction": "Standard", "status": "Draft", "description": "An attacker alters or establishes rogue processes in an integration facility in order to insert maliciously altered components into the system. The attacker would then supply the malicious components. This would allow for malicious disruption or additional compromise when the system is deployed.", "likelihood": "Low", "severity": "High", "prerequisites": ["Physical access to an integration facility that prepares the system before it is deployed at the victim location."], "examples": ["An attacker gains access to a system integrator's documentation for the preparation of purchased systems designated for deployment at the victim's location. As a part of the preparation, the included 100 megabit network card is to be replaced with a 1 gigabit network card. The documentation is alter..."]}, "528": {"name": "XML Flood", "abstraction": "Standard", "status": "Draft", "description": "An adversary may execute a flooding attack using XML messages with the intent to deny legitimate users access to a web service. These attacks are accomplished by sending a large number of XML based requests and letting the service attempt to parse each one. In many cases this type of an attack will result in a XML Denial of Service (XDoS) due to an application becoming unstable, freezing, or crashing.", "likelihood": "Low", "severity": "Medium", "prerequisites": ["The target must receive and process XML transactions.", "An adverssary must possess the ability to generate a large amount of XML based messages to send to the target service."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the target] Using a browser or an automated tool, an attacker records all instance of web services to process XML requests."}, {"step": "2", "phase": "Experiment", "description": "An adversary crafts input data that may have an adverse effect on the operation of the web service when the XML data sent to the service."}, {"step": "3", "phase": "Exploit", "description": "[Launch a resource depletion attack] The attacker delivers a large number of XML messages to the target URLs found in the explore phase at a sufficiently rapid rate. It causes denial of service to the..."}], "examples": ["Consider the case of attack performed against the createCustomerBillingAccount Web Service for an online store. In this case, the createCustomerBillingAccount Web Service receives a huge number of simultaneous requests, containing nonsense billing account creation information (the small XML messages..."], "related_cwes": ["CWE-770"]}, "529": {"name": "Malware-Directed Internal Reconnaissance", "abstraction": "Standard", "status": "Stable", "description": "Adversary uses malware or a similarly controlled application installed inside an organizational perimeter to gather information about the composition, configuration, and security mechanisms of a targeted application, system or network.", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The adversary must have internal, logical access to the target network and system."]}, "53": {"name": "Postfix, Null Terminate, and Backslash", "abstraction": "Detailed", "status": "Draft", "description": "If a string is passed through a filter of some kind, then a terminal NULL may not be valid. Using alternate representation of NULL allows an adversary to embed the NULL mid-string while postfixing the proper data so that the filter is avoided. One example is a filter that looks for a trailing slash character. If a string insertion is possible, but the slash must exist, an alternate encoding of NULL in mid-string may be used.", "likelihood": "High", "severity": "High", "prerequisites": ["Null terminators are not properly handled by the filter."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application."}, {"step": "2", "phase": "Experiment", "description": "[Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and injects postfix null byte(s) followed by a backslash to observe ..."}, {"step": "3", "phase": "Exploit", "description": "[Remove data after null byte(s)] After determined entry points that are vulnerable, the adversary places a null byte(s) followed by a backslash such that they bypass an input filter and remove data af..."}], "related_cwes": ["CWE-158", "CWE-172", "CWE-173", "CWE-74", "CWE-20", "CWE-697", "CWE-707"]}, "530": {"name": "Provide Counterfeit Component", "abstraction": "Detailed", "status": "Draft", "description": "An attacker provides a counterfeit component during the procurement process of a lower-tier component supplier to a sub-system developer or integrator, which is then built into the system being upgraded or repaired by the victim, allowing the attacker to cause disruption or additional compromise.", "likelihood": "Low", "severity": "High", "prerequisites": ["Advanced knowledge about the target system and sub-components."], "examples": ["The attacker, aware that the victim has contracted with an integrator for system maintenance and that the integrator uses commercial-off-the-shelf network hubs, develops their own network hubs with a built-in malicious capability for remote access, the malicious network hubs appear to be a well-know..."]}, "531": {"name": "Hardware Component Substitution", "abstraction": "Detailed", "status": "Draft", "description": "An attacker substitutes out a tested and approved hardware component for a maliciously-altered hardware component. This type of attack is carried out directly on the system, enabling the attacker to then cause disruption or additional compromise.", "likelihood": "Low", "severity": "High", "prerequisites": ["Physical access to the system or the integration facility where hardware components are kept."], "examples": ["An attacker has access to an organization's warehouse of card readers being included as a part of an overall security system. By replacing a critical hardware component in the card reader, the attacker is able to alter the function of the card reader to allow an attacker-supplied card to bypass a se..."]}, "532": {"name": "Altered Installed BIOS", "abstraction": "Detailed", "status": "Stable", "description": "An attacker with access to download and update system software sends a maliciously altered BIOS to the victim or victim supplier/integrator, which when installed allows for future exploitation.", "likelihood": "Low", "severity": "High", "prerequisites": ["Advanced knowledge about the installed target system design.", "Advanced knowledge about the download and update installation processes.", "Access to the download and update system(s) used to deliver BIOS images."], "examples": ["An attacker compromises the download and update portion of a manufacturer's web presence, and develops a malicious BIOS that in addition to the normal functionality will also at a specific time of day disable the remote access subsystem's security checks. The malicious BIOS is put in place on the ma..."]}, "533": {"name": "Malicious Manual Software Update", "abstraction": "Detailed", "status": "Draft", "description": "An attacker introduces malicious code to the victim's system by altering the payload of a software update, allowing for additional compromise or site disruption at the victim location. These manual, or user-assisted attacks, vary from requiring the user to download and run an executable, to as streamlined as tricking the user to click a URL. Attacks which aim at penetrating a specific network infrastructure often rely upon secondary attack methods to achieve the desired impact. Spamming, for exa...", "likelihood": "Low", "severity": "High", "prerequisites": ["Advanced knowledge about the download and update installation processes.", "Advanced knowledge about the deployed system and its various software subcomponents and processes."], "examples": ["An email campaign was initiated, targetting victims of a ransomware attack. The email claimed to be a patch to address the ransomware attack, but was instead an attachment that caused the Cobalt Strike tools to be installed, which enabled further attacks."], "related_cwes": ["CWE-494"]}, "534": {"name": "Malicious Hardware Update", "abstraction": "Standard", "status": "Stable", "description": "An adversary introduces malicious hardware during an update or replacement procedure, allowing for additional compromise or site disruption at the victim location. After deployment, it is not uncommon for upgrades and replacements to occur involving hardware and various replaceable parts. These upgrades and replacements are intended to correct defects, provide additional features, and to replace broken or worn-out parts. However, by forcing or tricking the replacement of a good component with a ...", "likelihood": "Low", "severity": "High", "examples": ["An adversary develops a malicious networking card that allows for normal function plus the addition of malicious functionality that is of benefit to the adversary. The adversary sends the victim an email stating that the existing networking card is faulty, and that the victim can order a replacement..."]}, "535": {"name": "Malicious Gray Market Hardware", "abstraction": "Detailed", "status": "Draft", "description": "An attacker maliciously alters hardware components that will be sold on the gray market, allowing for victim disruption and compromise when the victim needs replacement hardware components for systems where the parts are no longer in regular supply from original suppliers, or where the hardware components from the attacker seems to be a great benefit from a cost perspective.", "likelihood": "Low", "severity": "High", "prerequisites": ["Physical access to a gray market reseller's hardware components supply, or the ability to appear as a gray market reseller to the victim's buyer."], "examples": ["An attacker develops co-processor boards with malicious capabilities that are technically the same as a manufacturer's expensive upgrade to their flagship system. The victim has installed the manufacturer's base system without the expensive upgrade. The attacker contacts the victim and states they h..."]}, "536": {"name": "Data Injected During Configuration", "abstraction": "Standard", "status": "Stable", "description": "An attacker with access to data files and processes on a victim's system injects malicious data into critical operational data during configuration or recalibration, causing the victim's system to perform in a suboptimal manner that benefits the adversary.", "likelihood": "Low", "severity": "High", "prerequisites": ["The attacker must have previously compromised the victim's systems or have physical access to the victim's systems.", "Advanced knowledge of software and hardware capabilities of a manufacturer's product."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine configuration process] The adversary, through a previously compromised system, either remotely or physically, determines what the configuration process is. They look at configuration files,..."}, {"step": "2", "phase": "Explore", "description": "[Determine when configuration occurs] The adversary needs to then determine when configuration or recalibration of a system occurs so they know when to inject malicious data."}, {"step": "3", "phase": "Experiment", "description": "[Determine malicious data to inject] By looking at the configuration process, the adversary needs to determine what malicious data they want to insert and where to insert it."}, {"step": "4", "phase": "Exploit", "description": "[Inject malicious data] Right before, or during system configuration, the adversary injects the malicious data. This leads to the system behaving in a way that is beneficial to the adversary and is of..."}], "examples": ["An adversary wishes to bypass a security system to access an additional network segment where critical data is kept. The adversary knows that some configurations of the security system will allow for remote bypass under certain conditions, such as switching a specific parameter to a different value...."], "related_cwes": ["CWE-284"]}, "537": {"name": "Infiltration of Hardware Development Environment", "abstraction": "Detailed", "status": "Draft", "description": "An adversary, leveraging the ability to manipulate components of primary support systems and tools within the development and production environments, inserts malicious software within the hardware and/or firmware development environment. The infiltration purpose is to alter developed hardware components in a system destined for deployment at the victim's organization, for the purpose of disruption or further compromise.", "likelihood": "Low", "severity": "High", "prerequisites": ["The victim must use email or removable media from systems running the IDE (or systems adjacent to the IDE systems).", "The victim must have a system running exploitable applications and/or a vulnerable configuration to allow for initial infiltration.", "The adversary must have working knowledge of some if not all of the components involved in the IDE system as well as the infrastructure."]}, "538": {"name": "Open-Source Library Manipulation", "abstraction": "Detailed", "status": "Stable", "description": "Adversaries implant malicious code in open source software (OSS) libraries to have it widely distributed, as OSS is commonly downloaded by developers and other users to incorporate into software development projects. The adversary can have a particular system in mind to target, or the implantation can be the first stage of follow-on attacks on many systems.", "likelihood": "Low", "severity": "High", "prerequisites": ["Access to the open source code base being used by the manufacturer in a system being developed or currently deployed at a victim location."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine the relevant open-source code project to target] The adversary will make the selection based on various criteria:"}, {"step": "2", "phase": "Experiment", "description": "[Develop a plan for malicious contribution] The adversary develops a plan to contribute malicious code, taking the following into consideration:"}, {"step": "3", "phase": "Exploit", "description": "[Execute the plan for malicious contribution] Write the code to be contributed based on the plan and then submit the contribution. Multiple commits, possibly using multiple identities, will help obscu..."}], "examples": ["An adversary with access to an open source code project introduces a hard-to-find bug in the software that allows under very specific conditions for encryption to be disabled on data streams. The adversary commits the change to the code which is picked up by a manufacturer who develops VPN software...."], "related_cwes": ["CWE-494", "CWE-829"]}, "539": {"name": "ASIC With Malicious Functionality", "abstraction": "Detailed", "status": "Draft", "description": "An attacker with access to the development environment process of an application-specific integrated circuit (ASIC) for a victim system being developed or maintained after initial deployment can insert malicious functionality into the system for the purpose of disruption or further compromise.", "likelihood": "Low", "severity": "High", "prerequisites": ["The attacker must have working knowledge of some if not all of the components involved in the target system as well as the infrastructure and development environment of the manufacturer.", "Advanced knowledge about the ASIC installed within the target system."], "examples": ["A hardware manufacturer periodically updates its ASIC with new features. The attacker, knowing the manufacturer runs email on a system adjacent to the hardware development systems used for ASIC design, sends a phishing email with a malicious attachment to the manufacturer. When viewed, the malicious..."]}, "54": {"name": "Query System for Information", "abstraction": "Standard", "status": "Draft", "description": "An adversary, aware of an application's location (and possibly authorized to use the application), probes an application's structure and evaluates its robustness by submitting requests and examining responses. Often, this is accomplished by sending variants of expected queries in the hope that these modified queries might return information beyond what the expected set of queries would provide.", "likelihood": "High", "severity": "Low", "prerequisites": ["This class of attacks does not strictly require authorized access to the application. As Attackers use this attack process to classify, map, and identify vulnerable aspects of an application, it simpl..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine parameters] Determine all user-controllable parameters of the application either by probing or by finding documentation"}, {"step": "2", "phase": "Experiment", "description": "[Cause error condition] Inject each parameter with content that causes an error condition to manifest"}, {"step": "3", "phase": "Experiment", "description": "[Modify parameters] Modify the content of each parameter according to observed error conditions"}, {"step": "4", "phase": "Exploit", "description": "[Follow up attack] Once the above steps have been repeated with enough parameters, the application will be sufficiently mapped out. The adversary can then launch a desired attack (for example, Blind S..."}], "examples": ["Blind SQL injection is an example of this technique, applied to successful exploit. See also: CVE-2006-4705"], "related_cwes": ["CWE-209"]}, "540": {"name": "Overread Buffers", "abstraction": "Standard", "status": "Draft", "description": "An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.", "likelihood": "Low", "severity": "High", "prerequisites": ["For this type of attack to be successful, a few prerequisites must be met. First, the targeted software must be written in a language that enables fine grained buffer control. (e.g., c, c++) Second, t..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target application] The adversary identifies a target application or program to perform the buffer overread on. Adversaries often look for applications that accept user input and that perfor..."}, {"step": "2", "phase": "Experiment", "description": "[Find attack vector] The adversary identifies an attack vector by looking for areas in the application where they can specify to read more data than is required."}, {"step": "3", "phase": "Exploit", "description": "[Overread the buffer] The adversary provides input to the application that gets it to read past the bounds of a buffer, possibly revealing sensitive information that was not intended to be given to th..."}], "related_cwes": ["CWE-125"]}, "541": {"name": "Application Fingerprinting", "abstraction": "Standard", "status": "Draft", "description": "An adversary engages in fingerprinting activities to determine the type or version of an application installed on a remote target.", "severity": "Low", "prerequisites": ["None"], "related_cwes": ["CWE-204", "CWE-205", "CWE-208"]}, "542": {"name": "Targeted Malware", "abstraction": "Standard", "status": "Draft", "description": "An adversary develops targeted malware that takes advantage of a known vulnerability in an organizational information technology environment. The malware crafted for these attacks is based specifically on information gathered about the technology environment. Successfully executing the malware enables an adversary to achieve a wide variety of negative technical impacts."}, "543": {"name": "Counterfeit Websites", "abstraction": "Detailed", "status": "Draft", "description": "Adversary creates duplicates of legitimate websites. When users visit a counterfeit site, the site can gather information or upload malware.", "severity": "High", "prerequisites": ["None"]}, "544": {"name": "Counterfeit Organizations", "abstraction": "Detailed", "status": "Draft", "description": "An adversary creates a false front organizations with the appearance of a legitimate supplier in the critical life cycle path that then injects corrupted/malicious information system components into the organizational supply chain.", "severity": "High", "prerequisites": ["None"]}, "545": {"name": "Pull Data from System Resources", "abstraction": "Standard", "status": "Draft", "description": "An adversary who is authorized or has the ability to search known system resources, does so with the intention of gathering useful information. System resources include files, memory, and other aspects of the target system. In this pattern of attack, the adversary does not necessarily know what they are going to find when they start pulling data. This is different than CAPEC-150 where the adversary knows what they are looking for due to the common location.", "related_cwes": ["CWE-1239", "CWE-1243", "CWE-1258", "CWE-1266", "CWE-1272", "CWE-1278", "CWE-1323", "CWE-1258", "CWE-1330"]}, "546": {"name": "Incomplete Data Deletion in a Multi-Tenant Environment", "abstraction": "Detailed", "status": "Draft", "description": "An adversary obtains unauthorized information due to insecure or incomplete data deletion in a multi-tenant environment. If a cloud provider fails to completely delete storage and data from former cloud tenants' systems/resources, once these resources are allocated to new, potentially malicious tenants, the latter can probe the provided resources for sensitive information still there.", "likelihood": "Low", "severity": "Medium", "prerequisites": ["The cloud provider must not assuredly delete part or all of the sensitive data for which they are responsible.The adversary must have the ability to interact with the system."], "related_cwes": ["CWE-284", "CWE-1266", "CWE-1272"]}, "547": {"name": "Physical Destruction of Device or Component", "abstraction": "Standard", "status": "Draft", "description": "An adversary conducts a physical attack a device or component, destroying it such that it no longer functions as intended."}, "548": {"name": "Contaminate Resource", "abstraction": "Meta", "status": "Draft", "description": "An adversary contaminates organizational information systems (including devices and networks) by causing them to handle information of a classification/sensitivity for which they have not been authorized. When this happens, the contaminated information system, device, or network must be brought offline to investigate and mitigate the data spill, which denies availability of the system until the investigation is complete.", "likelihood": "Low", "severity": "High", "prerequisites": ["The adversary needs to have real or fake classified/sensitive information to place on a system"]}, "549": {"name": "Local Execution of Code", "abstraction": "Meta", "status": "Stable", "description": "An adversary installs and executes malicious code on the target system in an effort to achieve a negative technical impact. Examples include rootkits, ransomware, spyware, adware, and others.", "likelihood": "Medium", "severity": "High", "prerequisites": ["Knowledge of the target system's vulnerabilities that can be capitalized on with malicious code.The adversary must be able to place the malicious code on the target system."], "examples": ["BlueBorne refers to a set of nine vulnerabilities on different platforms (Linux, Windows, Android, iOS) that offer an adversary the ability to install and execute malicious code on a system if they were close in proximity to a Bluetooth enabled device. One vulnerability affecting iOS versions 7 thro..."], "related_cwes": ["CWE-829"]}, "55": {"name": "Rainbow Table Password Cracking", "abstraction": "Detailed", "status": "Draft", "description": "An attacker gets access to the database table where hashes of passwords are stored. They then use a rainbow table of pre-computed hash chains to attempt to look up the original password. Once the original password corresponding to the hash is obtained, the attacker uses the original password to gain access to the system.", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["Hash of the original password is available to the attacker. For a better chance of success, an attacker should have more than one hash of the original password, and ideally the whole table.", "Salt was not used to create the hash of the original password. Otherwise the rainbow tables have to be re-computed, which is very expensive and will make the attack effectively infeasible (especially ...", "The system uses one factor password based authentication."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine application's/system's password policy] Determine the password policies of the target application/system."}, {"step": "2", "phase": "Explore", "description": "[Obtain password hashes] An attacker gets access to the database table storing hashes of passwords or potentially just discovers a hash of an individual password."}, {"step": "3", "phase": "Exploit", "description": "[Run rainbow table-based password cracking tool] An attacker finds or writes a password cracking tool that uses a previously computed rainbow table for the right hashing algorithm. It helps if the att..."}], "examples": ["BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables. See also: CVE-2006-1058"], "related_cwes": ["CWE-261", "CWE-521", "CWE-262", "CWE-263", "CWE-654", "CWE-916", "CWE-308", "CWE-309"]}, "550": {"name": "Install New Service", "abstraction": "Detailed", "status": "Draft", "description": "When an operating system starts, it also starts programs called services or daemons. Adversaries may install a new service which will be executed at startup (on a Windows system, by modifying the registry). The service name may be disguised by using a name from a related operating system or benign software. Services are usually run with elevated privileges.", "related_cwes": ["CWE-284"]}, "551": {"name": "Modify Existing Service", "abstraction": "Detailed", "status": "Draft", "description": "When an operating system starts, it also starts programs called services or daemons. Modifying existing services may break existing services or may enable services that are disabled/not commonly used.", "related_cwes": ["CWE-284", "CWE-522"]}, "552": {"name": "Install Rootkit ", "abstraction": "Detailed", "status": "Draft", "description": "An adversary exploits a weakness in authentication to install malware that alters the functionality and information provide by targeted operating system API calls. Often referred to as rootkits, it is often used to hide the presence of programs, files, network connections, services, drivers, and other system components.", "likelihood": "Medium", "severity": "High", "examples": ["A rootkit may take the form of a hypervisor. A hypervisor is a software layer that sits between the operating system and the processor. It presents a virtual running environment to the operating system. An example of a common hypervisor is Xen. Because a hypervisor operates at a level below the oper...", "Similar to a rootkit, a bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR). Adversaries may use bootkits to persist on systems at a layer below the operating system, which may make it difficult to perform f..."], "related_cwes": ["CWE-284"]}, "554": {"name": "Functionality Bypass", "abstraction": "Meta", "status": "Draft", "description": "An adversary attacks a system by bypassing some or all functionality intended to protect it. Often, a system user will think that protection is in place, but the functionality behind those protections has been disabled by the adversary.", "likelihood": "Medium", "severity": "High", "related_cwes": ["CWE-424", "CWE-1299"]}, "555": {"name": "Remote Services with Stolen Credentials", "abstraction": "Standard", "status": "Stable", "description": "This pattern of attack involves an adversary that uses stolen credentials to leverage remote services such as RDP, telnet, SSH, and VNC to log into a system. Once access is gained, any number of malicious activities could be performed.", "severity": "Very High", "examples": ["Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). There are othe...", "Windows Remote Management (WinRM) is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the winrm command or by any number of programs such as PowerShell."], "related_cwes": ["CWE-522", "CWE-308", "CWE-309", "CWE-294", "CWE-263", "CWE-262", "CWE-521"]}, "556": {"name": "Replace File Extension Handlers", "abstraction": "Detailed", "status": "Draft", "description": "When a file is opened, its file handler is checked to determine which program opens the file. File handlers are configuration properties of many operating systems. Applications can modify the file handler for a given file extension to call an arbitrary program when a file with the given extension is opened.", "related_cwes": ["CWE-284"]}, "557": {"name": "DEPRECATED: Schedule Software To Run", "abstraction": "Detailed", "status": "Deprecated", "description": "This CAPEC has been deprecated because it is not directly related to a weakness, social engineering, supply chains, or a physical-based attack."}, "558": {"name": "Replace Trusted Executable", "abstraction": "Detailed", "status": "Stable", "description": "An adversary exploits weaknesses in privilege management or access control to replace a trusted executable with a malicious version and enable the execution of malware when that trusted executable is called.", "likelihood": "Low", "severity": "High", "examples": ["Specific versions of Windows contain accessibility features that may be launched with a key combination before a user has logged in (for example when they are on the Windows Logon screen). On Windows XP and Windows Server 2003/R2, the program (e.g. \"C:\\Windows\\System32\\utilman.exe\") may be replaced ..."], "related_cwes": ["CWE-284"]}, "559": {"name": "Orbital Jamming", "abstraction": "Detailed", "status": "Draft", "description": "In this attack pattern, the adversary sends disruptive signals at a target satellite using a rogue uplink station to disrupt the intended transmission. Those within the satellite's footprint are prevented from reaching the satellite's targeted or neighboring channels. The satellite's footprint size depends upon its position in the sky; higher orbital satellites cover multiple continents.", "likelihood": "Low", "severity": "High", "prerequisites": ["This attack requires the knowledge of the satellite's coordinates for targeting."]}, "56": {"name": "DEPRECATED: Removing/short-circuiting 'guard logic'", "abstraction": "Standard", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is a duplicate of CAPEC-207 : Removing Important Client Functionality. Please refer to this other pattern going forward."}, "560": {"name": "Use of Known Domain Credentials", "abstraction": "Meta", "status": "Stable", "likelihood": "High", "severity": "High", "prerequisites": ["The system/application uses one factor password based authentication, SSO, and/or cloud-based authentication.", "The system/application does not have a sound password policy that is being enforced.", "The system/application does not implement an effective password throttling mechanism.", "The adversary possesses a list of known user accounts and corresponding passwords that may exist on the target."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Acquire known credentials] The adversary must obtain known credentials in order to access the target system, application, or service."}, {"step": "2", "phase": "Explore", "description": "[Determine target's password policy] Determine the password policies of the target system/application to determine if the known credentials fit within the specified criteria."}, {"step": "3", "phase": "Experiment", "description": "[Attempt authentication] Try each credential until the target grants access."}, {"step": "4", "phase": "Exploit", "description": "[Impersonate] An adversary can use successful experiments or authentications to impersonate an authorized user or system, or to laterally move within a system or application"}, {"step": "5", "phase": "Exploit", "description": "[Spoofing] Malicious data can be injected into the target system or into a victim user's system by an adversary. The adversary can also pose as a legitimate user to perform social engineering attacks."}, {"step": "6", "phase": "Exploit", "description": "[Data Exfiltration] The adversary can obtain sensitive data contained within the system or application."}], "examples": ["Throughout 2015 and 2016, APT28 \u2014 also known as Pawn Storm, Sednit, Fancy Bear, Sofacy, and STRONTIUM \u2014 leveraged stolen credentials to infiltrate the Democratic National Committee (DNC), the United States Army, the World Anti-Doping Agency (WADA), the Court of Arbitration for Sport (TAS-CAS), and m...", "In early 2019, FIN6 exploited stolen credentials from an organization within the engineering industry to laterally move within an environment via the Windows\u2019 Remote Desktop Protocol (RDP). Multiple servers were subsequently infected with malware to create malware distribution servers, which were us..."], "related_cwes": ["CWE-522", "CWE-307", "CWE-308", "CWE-309", "CWE-262", "CWE-263", "CWE-654", "CWE-1273"]}, "561": {"name": "Windows Admin Shares with Stolen Credentials", "abstraction": "Detailed", "status": "Draft", "description": "An adversary guesses or obtains (i.e. steals or purchases) legitimate Windows administrator credentials (e.g. userID/password) to access Windows Admin Shares on a local machine or within a Windows domain.", "prerequisites": ["The system/application is connected to the Windows domain.", "The target administrative share allows remote use of local admin credentials to log into domain systems.", "The adversary possesses a list of known Windows administrator credentials that exist on the target domain."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Acquire known Windows administrator credentials] The adversary must obtain known Windows administrator credentials in order to access the administrative network shares."}, {"step": "2", "phase": "Experiment", "description": "[Attempt domain authentication] Try each Windows administrator credential against the hidden network shares until the target grants access."}, {"step": "3", "phase": "Exploit", "description": "[Malware Execution] An adversary can remotely execute malware within the administrative network shares to infect other systems within the domain."}, {"step": "4", "phase": "Exploit", "description": "[Data Exfiltration] The adversary can remotely obtain sensitive data contained within the administrative network shares."}], "examples": ["APT32 has leveraged Windows' built-in Net utility to use Windows Administrative Shares to copy and execute remote malware. [REF-579]", "In May 2017, APT15 laterally moved within a Windows domain via Windows Administrative Shares to copy files to and from compromised host systems. This further allowed for the remote execution of malware. [REF-578]"], "related_cwes": ["CWE-522", "CWE-308", "CWE-309", "CWE-294", "CWE-263", "CWE-262", "CWE-521"]}, "562": {"name": "Modify Shared File", "abstraction": "Detailed", "status": "Draft", "description": "An adversary manipulates the files in a shared location by adding malicious programs, scripts, or exploit code to valid content. Once a user opens the shared content, the tainted content is executed.", "related_cwes": ["CWE-284"]}, "563": {"name": "Add Malicious File to Shared Webroot", "abstraction": "Detailed", "status": "Draft", "description": "An adversaries may add malicious content to a website through the open file share and then browse to that content with a web browser to cause the server to execute the content. The malicious content will typically run under the context and permissions of the web server process, often resulting in local system or administrative privileges depending on how the web server is configured.", "related_cwes": ["CWE-284"]}, "564": {"name": "Run Software at Logon", "abstraction": "Detailed", "status": "Draft", "description": "Operating system allows logon scripts to be run whenever a specific user or users logon to a system. If adversaries can access these scripts, they may insert additional code into the logon script. This code can allow them to maintain persistence or move laterally within an enclave because it is executed every time the affected user or users logon to a computer. Modifying logon scripts can effectively bypass workstation and enclave firewalls. Depending on the access configuration of the logon scr...", "related_cwes": ["CWE-284"]}, "565": {"name": "Password Spraying", "abstraction": "Detailed", "status": "Draft", "likelihood": "High", "severity": "High", "prerequisites": ["The system/application uses one factor password based authentication.", "The system/application does not have a sound password policy that is being enforced.", "The system/application does not implement an effective password throttling mechanism.", "The adversary possesses a list of known user accounts on the target system/application."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine target's password policy] Determine the password policies of the target system/application."}, {"step": "2", "phase": "Explore", "description": "[Select passwords] Pick the passwords to be used in the attack (e.g. commonly used passwords, passwords tailored to individual users, etc.)"}, {"step": "3", "phase": "Exploit", "description": "[Brute force password] Given the finite space of possible passwords dictated by information determined in the previous steps, try each password for all known user accounts until the target grants acce..."}], "examples": ["A user selects the phrase \"Password123\" as their password, believing that it would be very difficult to guess. Password Spraying, leveraging a list of commonly used passwords, is used to crack this password and gain access to the account.", "The Iranian hacker group APT33 (AKA Holmium, Refined Kitten, or Elfin) carried out numerous Password Spraying attacks in 2019. On average, APT33 targeted 2,000 organizations per month, with upwards of 10 million authentication attempts each day. The majority of these attacks targeted manufacturers, ..."], "related_cwes": ["CWE-521", "CWE-262", "CWE-263", "CWE-654", "CWE-307", "CWE-308", "CWE-309"]}, "566": {"name": "DEPRECATED: Dump Password Hashes", "abstraction": "Detailed", "status": "Deprecated", "description": "This CAPEC has been deprecated because of is not directly related to a weakness, social engineering, supply chains, or a physical-based attack."}, "567": {"name": "DEPRECATED: Obtain Data via Utilities", "abstraction": "Standard", "status": "Deprecated", "description": "This CAPEC has been deprecated because it is not directly related to a weakness, social engineering, supply chains, or a physical-based attack."}, "568": {"name": "Capture Credentials via Keylogger", "abstraction": "Detailed", "status": "Draft", "description": "An adversary deploys a keylogger in an effort to obtain credentials directly from a system's user. After capturing all the keystrokes made by a user, the adversary can analyze the data and determine which string are likely to be passwords or other credential related information.", "severity": "High", "prerequisites": ["The ability to install the keylogger, either in person or remote."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine which user's credentials to capture] Since this is a more targeted attack, an adversary will first identify a particular user they wish the capture the credentials of."}, {"step": "2", "phase": "Experiment", "description": "[Deploy keylogger] Once a user is identified, an adversary will deploy a keylogger to the user's system in one of many ways."}, {"step": "3", "phase": "Experiment", "description": "[Record keystrokes] Once the keylogger is deployed on the user's system, the adversary will record keystrokes over a period of time."}, {"step": "4", "phase": "Experiment", "description": "[Analyze data and determine credentials] Using the captured keystrokes, the adversary will be able to determine the credentials of the user."}, {"step": "5", "phase": "Exploit", "description": "[Use found credentials] After the adversary has found the credentials for the target user, they will then use them to gain access to a system in order to perform some follow-up attack"}]}, "569": {"name": "Collect Data as Provided by Users", "abstraction": "Standard", "status": "Draft", "description": "An attacker leverages a tool, device, or program to obtain specific information as provided by a user of the target system. This information is often needed by the attacker to launch a follow-on attack. This attack is different than Social Engineering as the adversary is not tricking or deceiving the user. Instead the adversary is putting a mechanism in place that captures the information that a user legitimately enters into a system. Deploying a keylogger, performing a UAC prompt, or wrapping t..."}, "57": {"name": "Utilizing REST's Trust in the System Resource to Obtain Sensitive Data", "abstraction": "Detailed", "status": "Draft", "description": "This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.", "likelihood": "Medium", "severity": "Very High", "prerequisites": ["Opportunity to intercept must exist beyond the point where SSL is terminated.", "The adversary must be able to insert a listener actively (proxying the communication) or passively (sniffing the communication) in the client-server communication path."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find a REST-style application that uses SSL] The adversary must first find a REST-style application that uses SSL to target. Because this attack is easier to carry out from inside of a server network..."}, {"step": "2", "phase": "Experiment", "description": "[Insert a listener to sniff client-server communication] The adversary inserts a listener that must exist beyond the point where SSL is terminated. This can be placed on the client side if it is belie..."}, {"step": "3", "phase": "Exploit", "description": "[Gather information passed in the clear] If developers have not hashed or encrypted data sent in the sniffed request, the adversary will be able to read this data in the clear. Most commonly, they wil..."}], "examples": ["The Rest service provider uses SSL to protect the communications between the service requester (client) to the service provider. In the instance where SSL is terminated before the communications reach the web server, it is very common in enterprise data centers to terminate SSL at a router, firewall..."], "related_cwes": ["CWE-300", "CWE-287", "CWE-693"]}, "570": {"name": "DEPRECATED: Signature-Based Avoidance", "abstraction": "Detailed", "status": "Deprecated", "description": "This CAPEC has been deprecated because it is not directly related to a weakness, social engineering, supply chains, or a physical-based attack."}, "571": {"name": "Block Logging to Central Repository", "abstraction": "Standard", "status": "Draft", "severity": "Low"}, "572": {"name": "Artificially Inflate File Sizes", "abstraction": "Standard", "status": "Draft", "likelihood": "High", "severity": "Medium"}, "573": {"name": "Process Footprinting", "abstraction": "Standard", "status": "Stable", "description": "An adversary exploits functionality meant to identify information about the currently running processes on the target system to an authorized user. By knowing what processes are running on the target system, the adversary can learn about the target environment as a means towards further malicious behavior.", "likelihood": "Low", "severity": "Low", "prerequisites": ["The adversary must have gained access to the target system via physical or logical means in order to carry out this attack."], "examples": ["On a Windows system, the command, \"tasklist,\" displays information about processes. The same function on a Mac OS system is done with the command, \"ps.\"", "In addition to manual discovery of running processes, an adversary can develop malware that carries out this attack pattern before subsequent malicious action."], "related_cwes": ["CWE-200"]}, "574": {"name": "Services Footprinting", "abstraction": "Standard", "status": "Stable", "description": "An adversary exploits functionality meant to identify information about the services on the target system to an authorized user. By knowing what services are registered on the target system, the adversary can learn about the target environment as a means towards further malicious behavior. Depending on the operating system, commands that can obtain services information include \"sc\" and \"tasklist/svc\" using Tasklist, and \"net start\" using Net.", "likelihood": "Low", "severity": "Low", "prerequisites": ["The adversary must have gained access to the target system via physical or logical means in order to carry out this attack."], "related_cwes": ["CWE-200"]}, "575": {"name": "Account Footprinting", "abstraction": "Standard", "status": "Stable", "description": "An adversary exploits functionality meant to identify information about the domain accounts and their permissions on the target system to an authorized user. By knowing what accounts are registered on the target system, the adversary can inform further and more targeted malicious behavior. Example Windows commands which can acquire this information are: \"net user\" and \"dsquery\".", "likelihood": "Low", "severity": "Low", "prerequisites": ["The adversary must have gained access to the target system via physical or logical means in order to carry out this attack."], "related_cwes": ["CWE-200"]}, "576": {"name": "Group Permission Footprinting", "abstraction": "Standard", "status": "Stable", "description": "An adversary exploits functionality meant to identify information about user groups and their permissions on the target system to an authorized user. By knowing what users/permissions are registered on the target system, the adversary can inform further and more targeted malicious behavior. An example Windows command which can list local groups is \"net localgroup\".", "likelihood": "Low", "severity": "Low", "prerequisites": ["The adversary must have gained access to the target system via physical or logical means in order to carry out this attack."], "related_cwes": ["CWE-200"]}, "577": {"name": "Owner Footprinting", "abstraction": "Standard", "status": "Draft", "description": "An adversary exploits functionality meant to identify information about the primary users on the target system to an authorized user. They may do this, for example, by reviewing logins or file modification times. By knowing what owners use the target system, the adversary can inform further and more targeted malicious behavior. An example Windows command that may accomplish this is \"dir /A ntuser.dat\". Which will display the last modified time of a user's ntuser.dat file when run within the root...", "likelihood": "Low", "severity": "Low", "prerequisites": ["The adversary must have gained access to the target system via physical or logical means in order to carry out this attack.", "Administrator permissions are required to view the home folder of other users."], "related_cwes": ["CWE-200"]}, "578": {"name": "Disable Security Software", "abstraction": "Standard", "status": "Usable", "description": "An adversary exploits a weakness in access control to disable security tools so that detection does not occur. This can take the form of killing processes, deleting registry keys so that tools do not start at run time, deleting log files, or other methods.", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The adversary must have the capability to interact with the configuration of the targeted system."], "related_cwes": ["CWE-284"]}, "579": {"name": "Replace Winlogon Helper DLL", "abstraction": "Detailed", "status": "Draft", "description": "Winlogon is a part of Windows that performs logon actions. In Windows systems prior to Windows Vista, a registry key can be modified that causes Winlogon to load a DLL on startup. Adversaries may take advantage of this feature to load adversarial code at startup.", "related_cwes": ["CWE-15"]}, "58": {"name": "Restful Privilege Elevation", "abstraction": "Detailed", "status": "Draft", "description": "An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.", "likelihood": "High", "severity": "High", "prerequisites": ["The attacker needs to be able to identify HTTP Get URLs. The Get methods must be set to call applications that perform operations other than get such as update and delete."], "examples": ["The HTTP Get method is designed to retrieve resources and not to alter the state of the application or resources on the server side. However, developers can easily code programs that accept a HTTP Get request that do in fact create, update or delete data on the server. Both Flickr (http://www.flickr..."], "related_cwes": ["CWE-267", "CWE-269"]}, "580": {"name": "System Footprinting", "abstraction": "Standard", "status": "Stable", "description": "An adversary engages in active probing and exploration activities to determine security information about a remote target system. Often times adversaries will rely on remote applications that can be probed for system configurations.", "likelihood": "Low", "severity": "Low", "prerequisites": ["The adversary must have logical access to the target network and system."], "related_cwes": ["CWE-204", "CWE-205", "CWE-208"]}, "581": {"name": "Security Software Footprinting", "abstraction": "Detailed", "status": "Draft", "description": "Adversaries may attempt to get a listing of security tools that are installed on the system and their configurations. This may include security related system features (such as a built-in firewall or anti-spyware) as well as third-party security software."}, "582": {"name": "Route Disabling", "abstraction": "Standard", "status": "Draft", "description": "An adversary disables the network route between two targets. The goal is to completely sever the communications channel between two entities. This is often the result of a major error or the use of an \"Internet kill switch\" by those in control of critical infrastructure. This attack pattern differs from most other obstruction patterns by targeting the route itself, as opposed to the data passed over the route.", "likelihood": "Low", "severity": "High", "prerequisites": ["The adversary requires knowledge of and access to network route."]}, "583": {"name": "Disabling Network Hardware", "abstraction": "Detailed", "status": "Draft", "description": "In this attack pattern, an adversary physically disables networking hardware by powering it down or disconnecting critical equipment. Disabling or shutting off critical system resources prevents them from performing their service as intended, which can have direct and indirect consequences on other systems. This attack pattern is considerably less technical than the selective blocking used in most obstruction attacks.", "prerequisites": ["The adversary requires physical access to the targeted communications equipment (networking devices, cables, etc.), which may be spread over a wide area."]}, "584": {"name": "BGP Route Disabling", "abstraction": "Detailed", "status": "Draft", "description": "An adversary suppresses the Border Gateway Protocol (BGP) advertisement for a route so as to render the underlying network inaccessible. The BGP protocol helps traffic move throughout the Internet by selecting the most efficient route between Autonomous Systems (AS), or routing domains. BGP is the basis for interdomain routing infrastructure, providing connections between these ASs. By suppressing the intended AS routing advertisements and/or forcing less effective routes for traffic to ASs, the...", "prerequisites": ["The adversary must have control of a router that can modify, drop, or introduce spoofed BGP updates.The adversary can convince"], "examples": ["Blackholing: The adversary intentionally references false routing advertisements in order to attract traffic to a particular router so it can be dropped."]}, "585": {"name": "DNS Domain Seizure", "abstraction": "Detailed", "status": "Draft", "description": "In this attack pattern, an adversary influences a target's web-hosting company to disable a target domain. The goal is to prevent access to the targeted service provided by that domain. It usually occurs as the result of civil or criminal legal interventions.", "prerequisites": ["This attack pattern requires that the adversary has cooperation from the registrar of the target domain."], "examples": ["The FBI's seizure of gambling websites, the US DOJ's seizure of child pornography websites, and Microsoft's seizure of all domains owned by the company No-IP in order to disrupt a cyberattack originating from a subset of those domains."]}, "586": {"name": "Object Injection", "abstraction": "Meta", "status": "Draft", "description": "An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the de...", "likelihood": "Medium", "severity": "High", "prerequisites": ["The target application must unserialize data before validation."], "related_cwes": ["CWE-502"]}, "587": {"name": "Cross Frame Scripting (XFS)", "abstraction": "Detailed", "status": "Draft", "description": "This attack pattern combines malicious Javascript and a legitimate webpage loaded into a concealed iframe. The malicious Javascript is then able to interact with a legitimate webpage in a manner that is unknown to the user. This attack usually leverages some element of social engineering in that an attacker must convinces a user to visit a web page that the attacker controls.", "severity": "High", "prerequisites": ["The user's browser must have vulnerabilities in its implementation of the same-origin policy. It allows certain data in a loaded page to originate from different servers/domains."], "examples": ["An adversary-controlled webpage contains malicious Javascript and a concealed iframe containing a legitimate website login (i.e., the concealed iframe would make it appear as though the actual legitimate website was loaded). When the user interacts with the legitimate website in the iframe, the mali..."], "related_cwes": ["CWE-1021"]}, "588": {"name": "DOM-Based XSS", "abstraction": "Detailed", "status": "Stable", "description": "This type of attack is a form of Cross-Site Scripting (XSS) where a malicious script is inserted into the client-side HTML being parsed by a web browser. Content served by a vulnerable web application includes script code used to manipulate the Document Object Model (DOM). This script code either does not properly validate input, or does not perform proper output encoding, thus creating an opportunity for an adversary to inject a malicious script launch a XSS attack. A key distinction between ot...", "likelihood": "High", "severity": "Very High", "prerequisites": ["An application that leverages a client-side web browser with scripting enabled.", "An application that manipulates the DOM via client-side scripting.", "An application that failS to adequately sanitize or encode untrusted input."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser or an automated tool, an adversary follows all public links and actions on a web site. They record all the links, the forms, the r..."}, {"step": "2", "phase": "Experiment", "description": "[Probe identified potential entry points for DOM-based XSS vulnerability] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and injects various common script payload..."}, {"step": "3", "phase": "Experiment", "description": "[Craft malicious XSS URL] Once the adversary has determined which parameters are vulnerable to XSS, they will craft a malicious URL containing the XSS exploit. The adversary can have many goals, from ..."}, {"step": "4", "phase": "Exploit", "description": "[Get victim to click URL] In order for the attack to be successful, the victim needs to access the malicious URL."}], "related_cwes": ["CWE-79", "CWE-20", "CWE-83"]}, "589": {"name": "DNS Blocking", "abstraction": "Detailed", "status": "Draft", "description": "An adversary intercepts traffic and intentionally drops DNS requests based on content in the request. In this way, the adversary can deny the availability of specific services or content to the user even if the IP address is changed.", "prerequisites": ["This attack requires the ability to conduct deep packet inspection with an In-Path device that can drop the targeted traffic and/or connection."], "related_cwes": ["CWE-300"]}, "59": {"name": "Session Credential Falsification through Prediction", "abstraction": "Detailed", "status": "Draft", "description": "This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.", "likelihood": "High", "severity": "High", "prerequisites": ["The target host uses session IDs to keep track of the users.", "Session IDs are used to control access to resources.", "The session IDs used by the target host are predictable. For example, the session IDs are generated using predictable information (e.g., time)."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find Session IDs] The attacker interacts with the target host and finds that session IDs are used to authenticate users."}, {"step": "2", "phase": "Explore", "description": "[Characterize IDs] The attacker studies the characteristics of the session ID (size, format, etc.). As a results the attacker finds that legitimate session IDs are predictable."}, {"step": "3", "phase": "Experiment", "description": "[Match issued IDs] The attacker brute forces different values of session ID and manages to predict a valid session ID."}, {"step": "4", "phase": "Exploit", "description": "[Use matched Session ID] The attacker uses the falsified session ID to access the target system."}], "examples": ["Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly ...", "mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication. See also: CV..."], "related_cwes": ["CWE-290", "CWE-330", "CWE-331", "CWE-346", "CWE-488", "CWE-539", "CWE-200", "CWE-6", "CWE-285", "CWE-384", "CWE-693"]}, "590": {"name": "IP Address Blocking", "abstraction": "Detailed", "status": "Draft", "description": "An adversary performing this type of attack drops packets destined for a target IP address. The aim is to prevent access to the service hosted at the target IP address.", "likelihood": "Low", "severity": "High", "prerequisites": ["This attack requires the ability to conduct deep packet inspection with an In-Path device that can drop the targeted traffic and/or connection."], "examples": ["Consider situations of information censorship for political purposes, where regimes that prevent access to specific web services."], "related_cwes": ["CWE-300"]}, "591": {"name": "Reflected XSS", "abstraction": "Detailed", "status": "Stable", "description": "This type of attack is a form of Cross-Site Scripting (XSS) where a malicious script is \"reflected\" off a vulnerable web application and then executed by a victim's browser. The process starts with an adversary delivering a malicious script to a victim and convincing the victim to send the script to the vulnerable web application.", "likelihood": "High", "severity": "Very High", "prerequisites": ["An application that leverages a client-side web browser with scripting enabled.", "An application that fail to adequately sanitize or encode untrusted input."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser or an automated tool, an adversary follows all public links and actions on a web site. They record all the links, the forms, the r..."}, {"step": "2", "phase": "Experiment", "description": "[Probe identified potential entry points for reflected XSS vulnerability] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and injects various common script payload..."}, {"step": "3", "phase": "Experiment", "description": "[Craft malicious XSS URL] Once the adversary has determined which parameters are vulnerable to XSS, they will craft a malicious URL containing the XSS exploit. The adversary can have many goals, from ..."}, {"step": "4", "phase": "Exploit", "description": "[Get victim to click URL] In order for the attack to be successful, the victim needs to access the malicious URL."}], "related_cwes": ["CWE-79"]}, "592": {"name": "Stored XSS", "abstraction": "Detailed", "status": "Stable", "description": "An adversary utilizes a form of Cross-site Scripting (XSS) where a malicious script is persistently \"stored\" within the data storage of a vulnerable web application as valid input.", "likelihood": "High", "severity": "Very High", "prerequisites": ["An application that leverages a client-side web browser with scripting enabled.", "An application that fails to adequately sanitize or encode untrusted input.", "An application that stores information provided by the user in data storage of some kind."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for stored user-controllable inputs] Using a browser or an automated tool, an adversary follows all public links and actions on a web site. They record all the links, the forms..."}, {"step": "2", "phase": "Experiment", "description": "[Probe identified potential entry points for stored XSS vulnerability] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and injects various common script payloads a..."}, {"step": "3", "phase": "Experiment", "description": "[Store malicious XSS content] Once the adversary has determined which stored locations are vulnerable to XSS, they will interact with the web application to store the malicious content. The adversary ..."}, {"step": "4", "phase": "Exploit", "description": "[Get victim to view stored content] In order for the attack to be successful, the victim needs to view the stored malicious content on the webpage."}], "examples": ["An adversary determines that a system uses a web based interface for administration. The adversary creates a new user record and supplies a malicious script in the user name field. The user name field is not validated by the system and a new log entry is created detailing the creation of the new use...", "An online discussion forum allows its members to post HTML-enabled messages, which can also include image tags. An adversary embeds JavaScript in the image tags of their message. The adversary then sends the victim an email advertising free goods and provides a link to the form for how to collect. W..."], "related_cwes": ["CWE-79"]}, "593": {"name": "Session Hijacking", "abstraction": "Standard", "status": "Stable", "description": "This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.", "likelihood": "High", "severity": "Very High", "prerequisites": ["An application that leverages sessions to perform authentication."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Discover Existing Session Token] Through varrying means, an adversary will discover and store an existing session token for some other authenticated user session."}, {"step": "2", "phase": "Experiment", "description": "[Insert Found Session Token] The attacker attempts to insert a found session token into communication with the targeted application to confirm viability for exploitation."}, {"step": "3", "phase": "Exploit", "description": "[Session Token Exploitation] The attacker leverages the captured session token to interact with the targeted application in a malicious fashion, impersonating the victim."}], "related_cwes": ["CWE-287"]}, "594": {"name": "Traffic Injection", "abstraction": "Meta", "status": "Stable", "description": "An adversary injects traffic into the target's network connection. The adversary is therefore able to degrade or disrupt the connection, and potentially modify the content. This is not a flooding attack, as the adversary is not focusing on exhausting resources. Instead, the adversary is crafting a specific input to affect the system in a particular way.", "prerequisites": ["The target application must leverage an open communications channel.", "The channel on which the target communicates must be vulnerable to interception (e.g., adversary in the middle attack - CAPEC-94)."], "related_cwes": ["CWE-940"]}, "595": {"name": "Connection Reset", "abstraction": "Standard", "status": "Draft", "description": "In this attack pattern, an adversary injects a connection reset packet to one or both ends of a target's connection. The attacker is therefore able to have the target and/or the destination server sever the connection without having to directly filter the traffic between them.", "prerequisites": ["This attack requires the ability to monitor the target's network connection."], "related_cwes": ["CWE-940"]}, "596": {"name": "TCP RST Injection", "abstraction": "Detailed", "status": "Draft", "description": "An adversary injects one or more TCP RST packets to a target after the target has made a HTTP GET request. The goal of this attack is to have the target and/or destination web server terminate the TCP connection.", "prerequisites": ["An On/In Path Device"], "related_cwes": ["CWE-940"]}, "597": {"name": "Absolute Path Traversal", "abstraction": "Detailed", "status": "Draft", "description": "An adversary with access to file system resources, either directly or via application logic, will use various file absolute paths and navigation mechanisms such as \"..\" to extend their range of access to inappropriate areas of the file system. The goal of the adversary is to access directories and files that are intended to be restricted from their access.", "prerequisites": ["The target must leverage and access an underlying file system."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Fingerprinting of the operating system] In order to perform a valid path traversal, the adversary needs to know what the underlying OS is so that the proper file seperator is used."}, {"step": "2", "phase": "Explore", "description": "[Survey application] Using manual or automated means, an adversary will survey the target application looking for all areas where user input is taken to specify a file name or path."}, {"step": "3", "phase": "Experiment", "description": "[Attempt variations on input parameters] Using manual or automated means, an adversary attempts varying absolute file paths on all found user input locations and observes the responses."}, {"step": "4", "phase": "Exploit", "description": "[Access, modify, or execute arbitrary files.] An adversary injects absolute path traversal syntax into identified vulnerable inputs to cause inappropriate reading, writing or execution of files. An ad..."}], "related_cwes": ["CWE-36"]}, "598": {"name": "DNS Spoofing", "abstraction": "Detailed", "status": "Draft", "description": "An adversary sends a malicious (\"NXDOMAIN\" (\"No such domain\") code, or DNS A record) response to a target's route request before a legitimate resolver can. This technique requires an On-path or In-path device that can monitor and respond to the target's DNS requests. This attack differs from BGP Tampering in that it directly responds to requests made by the target instead of polluting the routing the target's infrastructure uses.", "prerequisites": ["On/In Path Device"], "examples": ["Below-Recursive DNS Poisoning: When an On/In-path device between a recursive DNS server and a user sends a malicious (\"NXDOMAIN\" (\"No such domain\") code, or DNS A record ) response before a legitimate resolver can.", "Above-Recursive DNS Poisoning: When an On/In-path device between an authority server (e.g., government-managed) and a recursive DNS server sends a malicious (\"NXDOMAIN\" (\"No such domain\")code, or a DNS record) response before a legitimate resolver can."]}, "599": {"name": "Terrestrial Jamming", "abstraction": "Detailed", "status": "Draft", "description": "In this attack pattern, the adversary transmits disruptive signals in the direction of the target's consumer-level satellite dish (as opposed to the satellite itself). The transmission disruption occurs in a more targeted range. Portable terrestrial jammers have a range of 3-5 kilometers in urban areas and 20 kilometers in rural areas. This technique requires a terrestrial jammer that is more powerful than the frequencies sent from the satellite.", "likelihood": "Low", "severity": "High", "examples": ["An attempt to deceive a GPS receiver by broadcasting counterfeit GPS signals, structured to resemble a set of normal GPS signals. These jamming signals may be structured in such a way as to cause the receiver to estimate its position to be somewhere other than where it actually is, or to be located ..."]}, "6": {"name": "Argument Injection", "abstraction": "Standard", "status": "Draft", "description": "An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.", "likelihood": "High", "severity": "High", "prerequisites": ["Target software fails to strip all user-supplied input of any content that could cause the shell to perform unexpected actions.", "Software must allow for unvalidated or unfiltered input to be executed on operating system shell, and, optionally, the system configuration must allow for output to be sent back to client."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Discovery of potential injection vectors] Using an automated tool or manual discovery, the attacker identifies services or methods with arguments that could potentially be used as injection vectors (..."}, {"step": "2", "phase": "Experiment", "description": "[1. Attempt variations on argument content] Possibly using an automated tool, the attacker will perform injection variations of the arguments."}, {"step": "3", "phase": "Exploit", "description": "[Abuse of the application] The attacker injects specific syntax into a particular argument in order to generate a specific malicious effect in the targeted application."}], "examples": ["A recent example instance of argument injection occurred against Java Web Start technology, which eases the client side deployment for Java programs. The JNLP files that are used to describe the properties for the program. The client side Java runtime used the arguments in the property setting to de..."], "related_cwes": ["CWE-74", "CWE-146", "CWE-184", "CWE-78", "CWE-185", "CWE-697"]}, "60": {"name": "Reusing Session IDs (aka Session Replay)", "abstraction": "Detailed", "status": "Draft", "description": "This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.", "likelihood": "High", "severity": "High", "prerequisites": ["The target host uses session IDs to keep track of the users.", "Session IDs are used to control access to resources.", "The session IDs used by the target host are not well protected from session theft."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "The attacker interacts with the target host and finds that session IDs are used to authenticate users."}, {"step": "2", "phase": "Explore", "description": "The attacker steals a session ID from a valid user."}, {"step": "3", "phase": "Exploit", "description": "The attacker tries to use the stolen session ID to gain access to the system with the privileges of the session ID's original owner."}], "examples": ["OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls. See also: CVE-1999-0428", "Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across sessions, which could allow remote attackers with access to the ID to gain privileges as that user, e.g. by extracting the ID from the user's answer or forward URLs. See also: CVE-2002-0258"], "related_cwes": ["CWE-294", "CWE-290", "CWE-346", "CWE-384", "CWE-488", "CWE-539", "CWE-200", "CWE-285", "CWE-664", "CWE-732"]}, "600": {"name": "Credential Stuffing", "abstraction": "Standard", "status": "Stable", "likelihood": "High", "severity": "High", "prerequisites": ["The system/application uses one factor password based authentication, SSO, and/or cloud-based authentication.", "The system/application does not have a sound password policy that is being enforced.", "The system/application does not implement an effective password throttling mechanism.", "The adversary possesses a list of known user accounts and corresponding passwords that may exist on the target."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Acquire known credentials] The adversary must obtain known credentials in order to access the target system, application, or service."}, {"step": "2", "phase": "Explore", "description": "[Determine target's password policy] Determine the password policies of the target system/application to determine if the known credentials fit within the specified criteria."}, {"step": "3", "phase": "Experiment", "description": "[Attempt authentication] Try each username/password combination until the target grants access."}, {"step": "3", "phase": "Exploit", "description": "[Impersonate] An adversary can use successful experiments or authentications to impersonate an authorized user or system or to laterally move within a system or application"}, {"step": "4", "phase": "Exploit", "description": "[Spoofing] Malicious data can be injected into the target system or into a victim user's system by an adversary. The adversary can also pose as a legitimate user to perform social engineering attacks."}, {"step": "5", "phase": "Exploit", "description": "[Data Exfiltration] The adversary can obtain sensitive data contained within the system or application."}], "examples": ["A user leverages the password \"Password123\" for a handful of application logins. An adversary obtains a victim's username/password combination from a breach of a social media application and executes a Credential Stuffing attack against multiple banking and credit card applications. Since the user l...", "In October 2014 J.P. Morgan's Corporate Challenge website was breached, resulting in adversaries obtaining multiple username/password pairs. A Credential Stuffing attack was then executed against J.P. Morgan Chase, which resulted in over 76 million households having their accounts compromised."], "related_cwes": ["CWE-522", "CWE-307", "CWE-308", "CWE-309", "CWE-262", "CWE-263", "CWE-654"]}, "601": {"name": "Jamming", "abstraction": "Standard", "status": "Draft", "description": "An adversary uses radio noise or signals in an attempt to disrupt communications. By intentionally overwhelming system resources with illegitimate traffic, service is denied to the legitimate traffic of authorized users.", "likelihood": "Medium", "severity": "High"}, "602": {"name": "DEPRECATED: Degradation", "abstraction": "Meta", "status": "Deprecated", "description": "This attack pattern has been deprecated."}, "603": {"name": "Blockage", "abstraction": "Standard", "status": "Draft", "description": "An adversary blocks the delivery of an important system resource causing the system to fail or stop working.", "likelihood": "Medium", "severity": "High", "prerequisites": ["This attack pattern requires knowledge of where important system resources are logically located as well as how they operate."]}, "604": {"name": "Wi-Fi Jamming", "abstraction": "Detailed", "status": "Draft", "description": "In this attack scenario, the attacker actively transmits on the Wi-Fi channel to prevent users from transmitting or receiving data from the targeted Wi-Fi network. There are several known techniques to perform this attack \u2013 for example: the attacker may flood the Wi-Fi access point (e.g. the retransmission device) with deauthentication frames. Another method is to transmit high levels of noise on the RF band used by the Wi-Fi network.", "likelihood": "Medium", "severity": "High", "prerequisites": ["Lack of anti-jam features in 802.11", "Lack of authentication on deauthentication/disassociation packets on 802.11-based networks"]}, "605": {"name": "Cellular Jamming", "abstraction": "Detailed", "status": "Draft", "description": "In this attack scenario, the attacker actively transmits signals to overpower and disrupt the communication between a cellular user device and a cell tower. Several existing techniques are known in the open literature for this attack for 2G, 3G, and 4G LTE cellular technology. For example, some attacks target cell towers by overwhelming them with false status messages, while others introduce high levels of noise on signaling channels.", "severity": "Low", "prerequisites": ["Lack of anti-jam features in cellular technology (2G, 3G, 4G, LTE)"]}, "606": {"name": "Weakening of Cellular Encryption", "abstraction": "Detailed", "status": "Draft", "description": "An attacker, with control of a Cellular Rogue Base Station or through cooperation with a Malicious Mobile Network Operator can force the mobile device (e.g., the retransmission device) to use no encryption (A5/0 mode) or to use easily breakable encryption (A5/1 or A5/2 mode).", "severity": "High", "prerequisites": ["Cellular devices that allow negotiating security modes to facilitate backwards compatibility and roaming on legacy networks."], "related_cwes": ["CWE-757"]}, "607": {"name": "Obstruction", "abstraction": "Meta", "status": "Draft", "description": "An attacker obstructs the interactions between system components. By interrupting or disabling these interactions, an adversary can often force the system into a degraded state or cause the system to stop working as intended. This can cause the system components to be unavailable until the obstruction mitigated."}, "608": {"name": "Cryptanalysis of Cellular Encryption", "abstraction": "Detailed", "status": "Draft", "description": "The use of cryptanalytic techniques to derive cryptographic keys or otherwise effectively defeat cellular encryption to reveal traffic content. Some cellular encryption algorithms such as A5/1 and A5/2 (specified for GSM use) are known to be vulnerable to such attacks and commercial tools are available to execute these attacks and decrypt mobile phone conversations in real-time. Newer encryption algorithms in use by UMTS and LTE are stronger and currently believed to be less vulnerable to these ...", "severity": "High", "prerequisites": ["None"], "related_cwes": ["CWE-327"]}, "609": {"name": "Cellular Traffic Intercept", "abstraction": "Detailed", "status": "Draft", "description": "Cellular traffic for voice and data from mobile devices and retransmission devices can be intercepted via numerous methods. Malicious actors can deploy their own cellular tower equipment and intercept cellular traffic surreptitiously. Additionally, government agencies of adversaries and malicious actors can intercept cellular traffic via the telecommunications backbone over which mobile traffic is transmitted.", "severity": "Low", "prerequisites": ["None"], "related_cwes": ["CWE-311"]}, "61": {"name": "Session Fixation", "abstraction": "Detailed", "status": "Draft", "description": "The attacker induces a client to establish a session with the target software using a session identifier provided by the attacker. Once the user successfully authenticates to the target software, the attacker uses the (now privileged) session identifier in their own transactions. This attack leverages the fact that the target software either relies on client-generated session identifiers or maintains the same session identifiers after privilege elevation.", "likelihood": "Medium", "severity": "High", "prerequisites": ["Session identifiers that remain unchanged when the privilege levels change.", "Permissive session management mechanism that accepts random user-generated session identifiers", "Predictable session identifiers"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Setup the Attack] Setup a session: The attacker has to setup a trap session that provides a valid session identifier, or select an arbitrary identifier, depending on the mechanism employed by the app..."}, {"step": "2", "phase": "Experiment", "description": "[Attract a Victim] Fixate the session: The attacker now needs to transfer the session identifier from the trap session to the victim by introducing the session identifier into the victim's browser. Th..."}, {"step": "3", "phase": "Exploit", "description": "[Abuse the Victim's Session] Takeover the fixated session: Once the victim has achieved a higher level of privilege, possibly by logging into the application, the attacker can now take over the sessio..."}], "examples": ["Consider a banking application that issues a session identifier in the URL to a user before login, and uses the same identifier to identify the customer following successful authentication. An attacker can easily leverage session fixation to access a victim's account by having the victim click on a ...", "An attacker can hijack user sessions, bypass authentication controls and possibly gain administrative privilege by fixating the session of a user authenticating to the Management Console on certain versions of Macromedia JRun 4.0. This can be achieved by setting the session identifier in the user's ..."], "related_cwes": ["CWE-384", "CWE-664", "CWE-732"]}, "610": {"name": "Cellular Data Injection", "abstraction": "Standard", "status": "Stable", "description": "Adversaries inject data into mobile technology traffic (data flows or signaling data) to disrupt communications or conduct additional surveillance operations.", "severity": "High", "prerequisites": ["None"]}, "611": {"name": "BitSquatting", "abstraction": "Detailed", "status": "Draft", "description": "An adversary registers a domain name one bit different than a trusted domain. A BitSquatting attack leverages random errors in memory to direct Internet traffic to adversary-controlled destinations. BitSquatting requires no exploitation or complicated reverse engineering, and is operating system and architecture agnostic. Experimental observations show that BitSquatting popular websites could redirect non-trivial amounts of Internet traffic to a malicious entity.", "likelihood": "Low", "severity": "Medium", "prerequisites": ["An adversary requires knowledge of popular or high traffic domains, that could be used to deceive potential targets."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine target website] The adversary first determines which website to impersonate, generally one that is trusted and receives a consistent amount of traffic."}, {"step": "2", "phase": "Experiment", "description": "[Impersonate trusted domain] In order to impersonate the trusted domain, the adversary needs to register the BitSquatted URL."}, {"step": "3", "phase": "Exploit", "description": "[Wait for a user to visit the domain] Finally, the adversary simply waits for a user to be unintentionally directed to the BitSquatted domain."}]}, "612": {"name": "WiFi MAC Address Tracking", "abstraction": "Detailed", "status": "Draft", "description": "In this attack scenario, the attacker passively listens for WiFi messages and logs the associated Media Access Control (MAC) addresses. These addresses are intended to be unique to each wireless device (although they can be configured and changed by software). Once the attacker is able to associate a MAC address with a particular user or set of users (for example, when attending a public event), the attacker can then scan for that MAC address to track that user in the future.", "severity": "Low", "prerequisites": ["None"], "related_cwes": ["CWE-201", "CWE-300"]}, "613": {"name": "WiFi SSID Tracking", "abstraction": "Detailed", "status": "Draft", "description": "In this attack scenario, the attacker passively listens for WiFi management frame messages containing the Service Set Identifier (SSID) for the WiFi network. These messages are frequently transmitted by WiFi access points (e.g., the retransmission device) as well as by clients that are accessing the network (e.g., the handset/mobile device). Once the attacker is able to associate an SSID with a particular user or set of users (for example, when attending a public event), the attacker can then sc...", "severity": "Low", "prerequisites": ["None"], "related_cwes": ["CWE-201", "CWE-300"]}, "614": {"name": "Rooting SIM Cards", "abstraction": "Detailed", "status": "Draft", "description": "SIM cards are the de facto trust anchor of mobile devices worldwide. The cards protect the mobile identity of subscribers, associate devices with phone numbers, and increasingly store payment credentials, for example in NFC-enabled phones with mobile wallets. This attack leverages over-the-air (OTA) updates deployed via cryptographically-secured SMS messages to deliver executable code to the SIM. By cracking the DES key, an attacker can send properly signed binary SMS messages to a device, which...", "severity": "High", "prerequisites": ["A SIM card that relies on the DES cipher."], "related_cwes": ["CWE-327"]}, "615": {"name": "Evil Twin Wi-Fi Attack", "abstraction": "Detailed", "status": "Draft", "description": "Adversaries install Wi-Fi equipment that acts as a legitimate Wi-Fi network access point. When a device connects to this access point, Wi-Fi data traffic is intercepted, captured, and analyzed. This also allows the adversary to use \"adversary-in-the-middle\" (CAPEC-94) for all communications.", "severity": "Low", "prerequisites": ["None"], "related_cwes": ["CWE-300"]}, "616": {"name": "Establish Rogue Location", "abstraction": "Standard", "status": "Stable", "description": "An adversary provides a malicious version of a resource at a location that is similar to the expected location of a legitimate resource. After establishing the rogue location, the adversary waits for a victim to visit the location and access the malicious resource.", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["A resource is expected to available to the user."], "related_cwes": ["CWE-200"]}, "617": {"name": "Cellular Rogue Base Station", "abstraction": "Detailed", "status": "Draft", "description": "In this attack scenario, the attacker imitates a cellular base station with their own \"rogue\" base station equipment. Since cellular devices connect to whatever station has the strongest signal, the attacker can easily convince a targeted cellular device (e.g. the retransmission device) to talk to the rogue base station.", "severity": "Low", "prerequisites": ["None"]}, "618": {"name": "Cellular Broadcast Message Request", "abstraction": "Detailed", "status": "Draft", "description": "In this attack scenario, the attacker uses knowledge of the target\u2019s mobile phone number (i.e., the number associated with the SIM used in the retransmission device) to cause the cellular network to send broadcast messages to alert the mobile device. Since the network knows which cell tower the target\u2019s mobile device is attached to, the broadcast messages are only sent in the Location Area Code (LAC) where the target is currently located. By triggering the cellular broadcast message and then lis...", "severity": "Low", "prerequisites": ["The attacker must have knowledge of the target\u2019s mobile phone number."], "related_cwes": ["CWE-201"]}, "619": {"name": "Signal Strength Tracking", "abstraction": "Detailed", "status": "Draft", "description": "In this attack scenario, the attacker passively monitors the signal strength of the target\u2019s cellular RF signal or WiFi RF signal and uses the strength of the signal (with directional antennas and/or from multiple listening points at once) to identify the source location of the signal. Obtaining the signal of the target can be accomplished through multiple techniques such as through Cellular Broadcast Message Request or through the use of IMSI Tracking or WiFi MAC Address Tracking.", "severity": "Low", "related_cwes": ["CWE-201"]}, "62": {"name": "Cross Site Request Forgery", "abstraction": "Standard", "status": "Draft", "description": "An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applic...", "likelihood": "High", "severity": "Very High", "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Explore target website] The attacker first explores the target website to determine pieces of functionality that are of interest to them (e.g. money transfers). The attacker will need a legitimate us..."}, {"step": "2", "phase": "Experiment", "description": "[Create a link that when clicked on, will execute the interesting functionality.] The attacker needs to create a link that will execute some interesting functionality such as transfer money, change a ..."}, {"step": "3", "phase": "Exploit", "description": "[Convince user to click on link] Finally, the attacker needs to convince a user that is logged into the target website to click on a link to execute the CSRF attack."}], "related_cwes": ["CWE-352", "CWE-306", "CWE-664", "CWE-732", "CWE-1275"]}, "620": {"name": "Drop Encryption Level", "abstraction": "Standard", "status": "Draft", "description": "An attacker forces the encryption level to be lowered, thus enabling a successful attack against the encrypted data.", "severity": "High", "related_cwes": ["CWE-757"]}, "621": {"name": "Analysis of Packet Timing and Sizes", "abstraction": "Detailed", "status": "Draft", "description": "An attacker may intercept and log encrypted transmissions for the purpose of analyzing metadata such as packet timing and sizes. Although the actual data may be encrypted, this metadata may reveal valuable information to an attacker. Note that this attack is applicable to VOIP data as well as application data, especially for interactive apps that require precise timing and low-latency (e.g. thin-clients).", "severity": "Low", "prerequisites": ["Use of untrusted communication paths enables an attacker to intercept and log communications, including metadata such as packet timing and sizes."], "related_cwes": ["CWE-201"]}, "622": {"name": "Electromagnetic Side-Channel Attack", "abstraction": "Detailed", "status": "Draft", "description": "In this attack scenario, the attacker passively monitors electromagnetic emanations that are produced by the targeted electronic device as an unintentional side-effect of its processing. From these emanations, the attacker derives information about the data that is being processed (e.g. the attacker can recover cryptographic keys by monitoring emanations associated with cryptographic processing). This style of attack requires proximal access to the device, however attacks have been demonstrated ...", "severity": "Low", "prerequisites": ["Proximal access to the device."], "related_cwes": ["CWE-201"]}, "623": {"name": "Compromising Emanations Attack", "abstraction": "Detailed", "status": "Draft", "description": "Compromising Emanations (CE) are defined as unintentional signals which an attacker may intercept and analyze to disclose the information processed by the targeted equipment. Commercial mobile devices and retransmission devices have displays, buttons, microchips, and radios that emit mechanical emissions in the form of sound or vibrations. Capturing these emissions can help an adversary understand what the device is doing.", "severity": "Low", "prerequisites": ["Proximal access to the device."], "related_cwes": ["CWE-201"]}, "624": {"name": "Hardware Fault Injection", "abstraction": "Meta", "status": "Stable", "description": "The adversary uses disruptive signals or events, or alters the physical environment a device operates in, to cause faulty behavior in electronic devices. This can include electromagnetic pulses, laser pulses, clock glitches, ambient temperature extremes, and more. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information.", "likelihood": "Low", "severity": "High", "prerequisites": ["Physical access to the system", "The adversary must be cognizant of where fault injection vulnerabilities exist in the system in order to leverage them for exploitation."], "related_cwes": ["CWE-1247", "CWE-1248", "CWE-1256", "CWE-1319", "CWE-1332", "CWE-1334", "CWE-1338", "CWE-1351"]}, "625": {"name": "Mobile Device Fault Injection", "abstraction": "Standard", "status": "Draft", "description": "Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication tha...", "related_cwes": ["CWE-1247", "CWE-1248", "CWE-1256", "CWE-1319", "CWE-1332", "CWE-1334", "CWE-1338", "CWE-1351"]}, "626": {"name": "Smudge Attack", "abstraction": "Detailed", "status": "Draft", "description": "Attacks that reveal the password/passcode pattern on a touchscreen device by detecting oil smudges left behind by the user\u2019s fingers.", "prerequisites": ["The attacker must have physical access to the device."]}, "627": {"name": "Counterfeit GPS Signals", "abstraction": "Standard", "status": "Draft", "description": "An adversary attempts to deceive a GPS receiver by broadcasting counterfeit GPS signals, structured to resemble a set of normal GPS signals. These spoofed signals may be structured in such a way as to cause the receiver to estimate its position to be somewhere other than where it actually is, or to be located where it is but at a different time, as determined by the adversary.", "likelihood": "Low", "severity": "High", "prerequisites": ["The target must be relying on valid GPS signal to perform critical operations."]}, "628": {"name": "Carry-Off GPS Attack", "abstraction": "Detailed", "status": "Draft", "description": "A common form of a GPS spoofing attack, commonly termed a carry-off attack begins with an adversary broadcasting signals synchronized with the genuine signals observed by the target receiver. The power of the counterfeit signals is then gradually increased and drawn away from the genuine signals. Over time, the adversary can carry the target away from their intended destination and toward a location chosen by the adversary.", "likelihood": "Low", "severity": "High", "prerequisites": ["The target must be relying on valid GPS signal to perform critical operations."], "examples": ["A \"proof-of-concept\" attack was successfully performed in June, 2013, when the luxury yacht \"White Rose\" was misdirected with spoofed GPS signals from Monaco to the island of Rhodes by a group of aerospace engineering students from the Cockrell School of Engineering at the University of Texas in Aus..."]}, "629": {"name": "DEPRECATED: Unauthorized Use of Device Resources", "abstraction": "Standard", "status": "Deprecated", "description": "This attack pattern has been deprecated."}, "63": {"name": "Cross-Site Scripting (XSS)", "abstraction": "Standard", "status": "Draft", "description": "An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting the...", "likelihood": "High", "severity": "Very High", "prerequisites": ["Target client software must be a client that allows scripting communication from remote hosts, such as a JavaScript-enabled Web Browser."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser or an automated tool, an attacker follows all public links and actions on a web site. They record all the links, the forms, the re..."}, {"step": "2", "phase": "Experiment", "description": "[Probe identified potential entry points for XSS vulnerability] The attacker uses the entry points gathered in the \"Explore\" phase as a target list and injects various common script payloads to determ..."}, {"step": "3", "phase": "Exploit", "description": "[Steal session IDs, credentials, page content, etc.] As the attacker succeeds in exploiting the vulnerability, they can choose to steal user's credentials in order to reuse or to analyze them later on..."}, {"step": "4", "phase": "Exploit", "description": "[Forceful browsing] When the attacker targets the current application or another one (through CSRF vulnerabilities), the user will then be the one who perform the attacks without being aware of it. Th..."}, {"step": "5", "phase": "Exploit", "description": "[Content spoofing] By manipulating the content, the attacker targets the information that the user would like to get from the website."}], "related_cwes": ["CWE-79", "CWE-20"]}, "630": {"name": "TypoSquatting", "abstraction": "Detailed", "status": "Draft", "description": "An adversary registers a domain name with at least one character different than a trusted domain. A TypoSquatting attack takes advantage of instances where a user mistypes a URL (e.g. www.goggle.com) or not does visually verify a URL before clicking on it (e.g. phishing attack). As a result, the user is directed to an adversary-controlled destination. TypoSquatting does not require an attack against the trusted domain or complicated reverse engineering.", "likelihood": "Low", "severity": "Medium", "prerequisites": ["An adversary requires knowledge of popular or high traffic domains, that could be used to deceive potential targets."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine target website] The adversary first determines which website to impersonate, generally one that is trusted and receives a consistent amount of traffic."}, {"step": "2", "phase": "Experiment", "description": "[Impersonate trusted domain] In order to impersonate the trusted domain, the adversary needs to register the TypoSquatted URL."}, {"step": "3", "phase": "Exploit", "description": "[Deceive user into visiting domain] Finally, the adversary needs to deceive a user into visiting the TypoSquatted domain."}]}, "631": {"name": "SoundSquatting", "abstraction": "Detailed", "status": "Draft", "description": "An adversary registers a domain name that sounds the same as a trusted domain, but has a different spelling. A SoundSquatting attack takes advantage of a user's confusion of the two words to direct Internet traffic to adversary-controlled destinations. SoundSquatting does not require an attack against the trusted domain or complicated reverse engineering.", "likelihood": "Low", "severity": "Medium", "prerequisites": ["An adversary requires knowledge of popular or high traffic domains, that could be used to deceive potential targets."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine target website] The adversary first determines which website to impersonate, generally one that is trusted, receives a consistent amount of traffic, and is a homophone."}, {"step": "2", "phase": "Experiment", "description": "[Impersonate trusted domain] In order to impersonate the trusted domain, the adversary needs to register the SoundSquatted URL."}, {"step": "3", "phase": "Exploit", "description": "[Deceive user into visiting domain] Finally, the adversary needs to deceive a user into visiting the SoundSquatted domain."}]}, "632": {"name": "Homograph Attack via Homoglyphs", "abstraction": "Detailed", "status": "Draft", "description": "An adversary registers a domain name containing a homoglyph, leading the registered domain to appear the same as a trusted domain. A homograph attack leverages the fact that different characters among various character sets look the same to the user. Homograph attacks must generally be combined with other attacks, such as phishing attacks, in order to direct Internet traffic to the adversary-controlled destinations.", "likelihood": "Low", "severity": "Medium", "prerequisites": ["An adversary requires knowledge of popular or high traffic domains, that could be used to deceive potential targets."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine target website] The adversary first determines which website to impersonate, generally one that is trusted and receives a consistent amount of traffic."}, {"step": "2", "phase": "Experiment", "description": "[Impersonate trusted domain] In order to impersonate the trusted domain, the adversary needs to register the URL containing the homoglpyh character(s)."}, {"step": "3", "phase": "Exploit", "description": "[Deceive user into visiting domain] Finally, the adversary needs to deceive a user into visiting the Homograph domain."}], "related_cwes": ["CWE-1007"]}, "633": {"name": "Token Impersonation", "abstraction": "Detailed", "status": "Stable", "description": "An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.", "severity": "Medium", "prerequisites": ["This pattern of attack is only applicable when a downstream user leverages tokens to verify identity, and then takes action based on that identity."], "related_cwes": ["CWE-287", "CWE-1270"]}, "634": {"name": "Probe Audio and Video Peripherals", "abstraction": "Detailed", "status": "Stable", "description": "The adversary exploits the target system's audio and video functionalities through malware or scheduled tasks. The goal is to capture sensitive information about the target for financial, personal, political, or other gains which is accomplished by collecting communication data between two parties via the use of peripheral devices (e.g. microphones and webcams) or applications with audio and video capabilities (e.g. Skype) on a system.", "likelihood": "Low", "severity": "High", "prerequisites": ["Knowledge of the target device's or application\u2019s vulnerabilities that can be capitalized on with malicious code. The adversary must be able to place the malicious code on the target device."], "examples": ["An adversary can capture audio and video, and transmit the recordings to a C2 server or a similar capability.", "An adversary can capture and record from audio peripherals in a vehicle via a Car Whisperer attack. If an adversary is within close proximity to a vehicle with Bluetooth capabilities, they may attempt to connect to the hands-free system when it is in pairing mode. With successful authentication, if ...", "An adversary may also use a technique called Bluebugging, which is similar to Bluesnarfing but requires the adversary to be between 10-15 meters of the target device. Bluebugging creates a backdoor for an attacker to listen/record phone calls, forward calls, send SMS and retrieve the phonebook."], "related_cwes": ["CWE-267"]}, "635": {"name": "Alternative Execution Due to Deceptive Filenames", "abstraction": "Standard", "status": "Draft", "description": "The extension of a file name is often used in various contexts to determine the application that is used to open and use it. If an attacker can cause an alternative application to be used, it may be able to execute malicious code, cause a denial of service or expose sensitive information.", "severity": "High", "prerequisites": ["The use of the file must be controlled by the file extension."], "related_cwes": ["CWE-162"]}, "636": {"name": "Hiding Malicious Data or Code within Files", "abstraction": "Standard", "status": "Draft", "description": "Files on various operating systems can have a complex format which allows for the storage of other data, in addition to its contents. Often this is metadata about the file, such as a cached thumbnail for an image file. Unless utilities are invoked in a particular way, this data is not visible during the normal use of the file. It is possible for an attacker to store malicious data or code using these facilities, which would be difficult to discover.", "severity": "High", "prerequisites": ["The operating system must support a file system that allows for alternate data storage for a file."], "related_cwes": ["CWE-506"]}, "637": {"name": "Collect Data from Clipboard", "abstraction": "Detailed", "status": "Stable", "description": "The adversary exploits an application that allows for the copying of sensitive data or information by collecting information copied to the clipboard. Data copied to the clipboard can be accessed by other applications, such as malware built to exfiltrate or log clipboard contents on a periodic basis. In this way, the adversary aims to garner information to which they are unauthorized.", "likelihood": "Low", "severity": "Low", "prerequisites": ["The adversary must have a means (i.e., a pre-installed tool or background process) by which to collect data from the clipboard and store it. That is, when the target copies data to the clipboard (e.g...."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find an application that allows copying sensititve data to clipboad] An adversary first needs to find an application that allows copying and pasting of sensitive information. This could be an applica..."}, {"step": "2", "phase": "Experiment", "description": "[Target users of the application] An adversary will target users of the application in order to obtain the information in their clipboard on a periodic basic"}, {"step": "3", "phase": "Exploit", "description": "[Follow-up attack] Use any sensitive information found to carry out a follow-up attack"}], "related_cwes": ["CWE-267"]}, "638": {"name": "Altered Component Firmware", "abstraction": "Detailed", "status": "Stable", "description": "An adversary exploits systems features and/or improperly protected firmware of hardware components, such as Hard Disk Drives (HDD), with the goal of executing malicious code from within the component's Master Boot Record (MBR). Conducting this type of attack entails the adversary infecting the target with firmware altering malware, using known tools, and a payload. Once this malware is executed, the MBR is modified to include instructions to execute the payload at desired intervals and when the ...", "likelihood": "Low", "severity": "Very High", "prerequisites": ["Advanced knowledge about the target component's firmware", "Advanced knowledge about Master Boot Records (MBR)", "Advanced knowledge about tools used to insert firmware altering malware.", "Advanced knowledge about component shipments to the target organization."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Select Target] The adversary searches for a suitable target to attack, such as government and/or private industry organizations."}, {"step": "2", "phase": "Explore", "description": "[Identify Components] After selecting a target, the adversary determines whether a vulnerable component, such as a specific make and model of a HDD, is contained within the target system."}, {"step": "3", "phase": "Experiment", "description": "[Optional: Create Payload] If not using an already existing payload, the adversary creates their own to be executed at defined intervals and upon system boot processes. This payload may then be tested..."}, {"step": "4", "phase": "Exploit", "description": "[Insert Firmware Altering Malware] Once a vulnerable component has been identified, the adversary leverages known malware tools to infect the component's firmware and drop the payload within the compo..."}], "examples": ["In 2014, the Equation group was observed levering known malware tools to conduct component firmware alteration attacks against hard drives. In total, 12 HDD categories were shown to be vulnerable from manufacturers such as Western Digital, HGST, Samsung, and Seagate. Because of their complexity, onl..."]}, "639": {"name": "Probe System Files", "abstraction": "Detailed", "status": "Stable", "description": "An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.", "severity": "Medium", "prerequisites": ["An adversary has access to the file system of a system."], "examples": ["Adversaries may search local file systems and remote file shares for files containing passwords. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/b...", "Adversaries may search network shares on computers they have compromised to find files of interest."], "related_cwes": ["CWE-552"]}, "64": {"name": "Using Slashes and URL Encoding Combined to Bypass Validation Logic", "abstraction": "Detailed", "status": "Draft", "description": "This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character wou...", "likelihood": "High", "severity": "High", "prerequisites": ["The application accepts and decodes URL string request.", "The application performs insufficient filtering/canonicalization on the URLs."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "The attacker accesses the server using a specific URL."}, {"step": "2", "phase": "Experiment", "description": "The attacker tries to encode some special characters in the URL. The attacker find out that some characters are not filtered properly."}, {"step": "3", "phase": "Exploit", "description": "The attacker crafts a malicious URL string request and sends it to the server."}, {"step": "4", "phase": "Exploit", "description": "The server decodes and interprets the URL string. Unfortunately since the input filtering is not done properly, the special characters have harmful consequences."}], "related_cwes": ["CWE-177", "CWE-173", "CWE-172", "CWE-73", "CWE-22", "CWE-74", "CWE-20", "CWE-697", "CWE-707"]}, "640": {"name": "Inclusion of Code in Existing Process", "abstraction": "Detailed", "status": "Stable", "description": "The adversary takes advantage of a bug in an application failing to verify the integrity of the running process to execute arbitrary code in the address space of a separate live process. The adversary could use running code in the context of another process to try to access process's memory, system/network resources, etc. The goal of this attack is to evade detection defenses and escalate privileges by masking the malicious code under an existing legitimate process. Examples of approaches includ...", "likelihood": "Low", "severity": "High", "prerequisites": ["The targeted application fails to verify the integrity of the running process that allows an adversary to execute arbitrary code."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine target process] The adversary determines a process with sufficient privileges that they wish to include code into."}, {"step": "2", "phase": "Experiment", "description": "[Attempt to include simple code with known output] The adversary attempts to include very simple code into the existing process to determine if the code inclusion worked. The code will differ based on..."}, {"step": "3", "phase": "Exploit", "description": "[Include arbitrary code into existing process] Once an adversary has determined that including code into the existing process is possible, they will include code for a targeted purpose, such as access..."}], "related_cwes": ["CWE-114", "CWE-829"]}, "641": {"name": "DLL Side-Loading", "abstraction": "Detailed", "status": "Stable", "description": "An adversary places a malicious version of a Dynamic-Link Library (DLL) in the Windows Side-by-Side (WinSxS) directory to trick the operating system into loading this malicious DLL instead of a legitimate DLL. Programs specify the location of the DLLs to load via the use of WinSxS manifests or DLL redirection and if they aren't used then Windows searches in a predefined set of directories to locate the file. If the applications improperly specify a required DLL or WinSxS manifests aren't explici...", "likelihood": "Low", "severity": "High", "prerequisites": ["The target must fail to verify the integrity of the DLL before using them."], "related_cwes": ["CWE-706"]}, "642": {"name": "Replace Binaries", "abstraction": "Detailed", "status": "Draft", "description": "Adversaries know that certain binaries will be regularly executed as part of normal processing. If these binaries are not protected with the appropriate file system permissions, it could be possible to replace them with malware. This malware might be executed at higher system permission levels. A variation of this pattern is to discover self-extracting installation packages that unpack binaries to directories with weak file permissions which it does not clean up appropriately. These binaries can...", "severity": "High", "prerequisites": ["The attacker must be able to place the malicious binary on the target machine."], "examples": ["The installer for a previous version of Firefox would use a DLL maliciously placed in the default download directory instead of the existing DLL located elsewhere, probably due to DLL hijacking. This DLL would be run with administrator privileges if the installer has those privileges.", "By default, the Windows screensaver application SCRNSAVE.exe leverages the scrnsave.scr Portable Executable (PE) file in C:\\Windows\\system32\\. This value is set in the registry at HKEY_CURRENT_USER\\Control Panel\\Desktop, which can be modified by an adversary to instead point to a malicious program. ..."], "related_cwes": ["CWE-732"]}, "643": {"name": "Identify Shared Files/Directories on System", "abstraction": "Detailed", "status": "Draft", "description": "An adversary discovers connections between systems by exploiting the target system's standard practice of revealing them in searchable, common areas. Through the identification of shared folders/drives between systems, the adversary may further their goals of locating and collecting sensitive information/files, or map potential routes for lateral movement within the network.", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The adversary must have obtained logical access to the system by some means (e.g., via obtained credentials or planting malware on the system)."], "related_cwes": ["CWE-267", "CWE-200"]}, "644": {"name": "Use of Captured Hashes (Pass The Hash)", "abstraction": "Detailed", "status": "Stable", "description": "An adversary obtains (i.e. steals or purchases) legitimate Windows domain credential hash values to access systems within the domain that leverage the Lan Man (LM) and/or NT Lan Man (NTLM) authentication protocols.", "likelihood": "Medium", "severity": "High", "prerequisites": ["The system/application is connected to the Windows domain.", "The system/application leverages the Lan Man (LM) and/or NT Lan Man (NTLM) authentication protocols.", "The adversary possesses known Windows credential hash value pairs that exist on the target domain."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Acquire known Windows credential hash value pairs] The adversary must obtain known Windows credential hash value pairs of accounts that exist on the domain."}, {"step": "2", "phase": "Experiment", "description": "[Attempt domain authentication] Try each Windows credential hash value pair until the target grants access."}, {"step": "3", "phase": "Exploit", "description": "[Impersonate] An adversary can use successful experiments or authentications to impersonate an authorized user or system, or to laterally move within the domain"}, {"step": "4", "phase": "Exploit", "description": "[Spoofing] Malicious data can be injected into the target system or into other systems on the domain. The adversary can also pose as a legitimate domain user to perform social engineering attacks."}, {"step": "5", "phase": "Exploit", "description": "[Data Exfiltration] The adversary can obtain sensitive data contained within domain systems or applications."}], "examples": ["Adversaries exploited the Zoom video conferencing application during the 2020 COVID-19 pandemic to exfiltrate Windows domain credential hash value pairs from a target system. The attack entailed sending Universal Naming Convention (UNC) paths within the Zoom chat window of an unprotected Zoom call. ...", "Operation Soft Cell, which has been underway since at least 2012, leveraged a modified Mimikatz that dumped NTLM hashes. The acquired hashes were then used to authenticate to other systems within the network via Pass The Hash attacks. [REF-580]"], "related_cwes": ["CWE-522", "CWE-836", "CWE-308", "CWE-294", "CWE-308"]}, "645": {"name": "Use of Captured Tickets (Pass The Ticket)", "abstraction": "Detailed", "status": "Stable", "description": "An adversary uses stolen Kerberos tickets to access systems/resources that leverage the Kerberos authentication protocol. The Kerberos authentication protocol centers around a ticketing system which is used to request/grant access to services and to then access the requested services. An adversary can obtain any one of these tickets (e.g. Service Ticket, Ticket Granting Ticket, Silver Ticket, or Golden Ticket) to authenticate to a system/resource without needing the account's credentials. Depend...", "likelihood": "Low", "severity": "High", "prerequisites": ["The adversary needs physical access to the victim system.", "The use of a third-party credential harvesting tool."], "examples": ["Bronze Butler (also known as Tick), has been shown to leverage forged Kerberos Ticket Granting Tickets (TGTs) and Ticket Granting Service (TGS) tickets to maintain administrative access on a number of systems. [REF-584]"], "related_cwes": ["CWE-522", "CWE-294", "CWE-308"]}, "646": {"name": "Peripheral Footprinting", "abstraction": "Standard", "status": "Stable", "description": "Adversaries may attempt to obtain information about attached peripheral devices and components connected to a computer system. Examples may include discovering the presence of iOS devices by searching for backups, analyzing the Windows registry to determine what USB devices have been connected, or infecting a victim system with malware to report when a USB device has been connected. This may allow the adversary to gain additional insight about the system or network environment, which may be usef...", "likelihood": "Low", "severity": "Medium", "prerequisites": ["The adversary needs either physical or remote access to the victim system."], "related_cwes": ["CWE-200"]}, "647": {"name": "Collect Data from Registries", "abstraction": "Detailed", "status": "Draft", "description": "An adversary exploits a weakness in authorization to gather system-specific data and sensitive information within a registry (e.g., Windows Registry, Mac plist). These contain information about the system configuration, software, operating system, and security. The adversary can leverage information gathered in order to carry out further attacks.", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The adversary must have obtained logical access to the system by some means (e.g., via obtained credentials or planting malware on the system).", "The adversary must have capability to navigate the operating system to peruse the registry."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Gain logical access to system] An adversary must first gain logical access to the system it wants to gather registry information from,"}, {"step": "2", "phase": "Experiment", "description": "[Determine if the permissions are correct] Once logical access is gained, an adversary will determine if they have the proper permissions, or are authorized, to view registry information. If they do n..."}, {"step": "3", "phase": "Experiment", "description": "[Peruse registry for information] Once an adversary has access to a registry, they will gather all system-specific data and sensitive information that they deem useful."}, {"step": "4", "phase": "Exploit", "description": "[Follow-up attack] Use any information or weaknesses found to carry out a follow-up attack"}], "related_cwes": ["CWE-285"]}, "648": {"name": "Collect Data from Screen Capture", "abstraction": "Detailed", "status": "Draft", "description": "An adversary gathers sensitive information by exploiting the system's screen capture functionality. Through screenshots, the adversary aims to see what happens on the screen over the course of an operation. The adversary can leverage information gathered in order to carry out further attacks.", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The adversary must have obtained logical access to the system by some means (e.g., via obtained credentials or planting malware on the system)."], "related_cwes": ["CWE-267"]}, "649": {"name": "Adding a Space to a File Extension", "abstraction": "Detailed", "status": "Draft", "description": "An adversary adds a space character to the end of a file extension and takes advantage of an application that does not properly neutralize trailing special elements in file names. This extra space, which can be difficult for a user to notice, affects which default application is used to operate on the file and can be leveraged by the adversary to control execution.", "likelihood": "Low", "severity": "Medium", "prerequisites": ["The use of the file must be controlled by the file extension."], "related_cwes": ["CWE-46"]}, "65": {"name": "Sniff Application Code", "abstraction": "Detailed", "status": "Draft", "description": "An adversary passively sniffs network communications and captures application code bound for an authorized client. Once obtained, they can use it as-is, or through reverse-engineering glean sensitive information or exploit the trust relationship between the client and server. Such code may belong to a dynamic update to the client, a patch being applied to a client component or any such interaction where the client is authorized to communicate with the server.", "likelihood": "Low", "severity": "High", "prerequisites": ["The attacker must have the ability to place themself in the communication path between the client and server.", "The targeted application must receive some application code from the server; for example, dynamic updates, patches, applets or scripts.", "The attacker must be able to employ a sniffer on the network without being detected."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Set up a sniffer] The adversary sets up a sniffer in the path between the server and the client and watches the traffic."}, {"step": "2", "phase": "Exploit", "description": "[Capturing Application Code Bound During Patching]adversary knows that the computer/OS/application can request new applications to install, or it periodically checks for an available update. The adver..."}], "examples": ["Attacker receives notification that the computer/OS/application has an available update, loads a network sniffing tool, and extracts update data from subsequent communication. The attacker then proceeds to reverse engineer the captured stream to gain sensitive information, such as encryption keys, v...", "Plain code, such as applets or JavaScript, is also part of the executing application. If such code is transmitted unprotected, the attacker can capture the code and possibly reverse engineer it to gain sensitive information, such as encryption keys, validation algorithms and such."], "related_cwes": ["CWE-319", "CWE-311", "CWE-318", "CWE-693"]}, "650": {"name": "Upload a Web Shell to a Web Server", "abstraction": "Detailed", "status": "Draft", "description": "By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a \"gateway\" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.", "severity": "High", "prerequisites": ["The web server is susceptible to one of the various web application exploits that allows for uploading a shell file."], "related_cwes": ["CWE-287", "CWE-553"]}, "651": {"name": "Eavesdropping", "abstraction": "Standard", "status": "Draft", "description": "An adversary intercepts a form of communication (e.g. text, audio, video) by way of software (e.g., microphone and audio recording application), hardware (e.g., recording equipment), or physical means (e.g., physical proximity). The goal of eavesdropping is typically to gain unauthorized access to sensitive information about the target for financial, personal, political, or other gains. Eavesdropping is different from a sniffing attack as it does not take place on a network-based communication c...", "severity": "Medium", "prerequisites": ["The adversary typically requires physical proximity to the target's environment, whether for physical eavesdropping or for placing recording equipment. This is not always the case for software-based e..."], "related_cwes": ["CWE-200"]}, "652": {"name": "Use of Known Kerberos Credentials", "abstraction": "Standard", "status": "Draft", "description": "An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.", "likelihood": "Medium", "severity": "High", "prerequisites": ["The system/application leverages Kerberos authentication.", "The system/application uses one factor password-based authentication, SSO, and/or cloud-based authentication for Kerberos service accounts.", "The system/application does not have a sound password policy that is being enforced for Kerberos service accounts.", "The system/application does not implement an effective password throttling mechanism for authenticating to Kerberos service accounts.", "The targeted network allows for network sniffing attacks to succeed."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Acquire known Kerberos credentials] The adversary must obtain known Kerberos credentials in order to access the target system, application, or service within the domain."}, {"step": "2", "phase": "Experiment", "description": "[Attempt Kerberos authentication] Try each Kerberos credential against various resources within the domain until the target grants access."}, {"step": "3", "phase": "Exploit", "description": "[Impersonate] An adversary can use successful experiments or authentications to impersonate an authorized user or system, or to laterally move within the domain"}, {"step": "4", "phase": "Exploit", "description": "[Spoofing] Malicious data can be injected into the target system or into other systems on the domain. The adversary can also pose as a legitimate domain user to perform social engineering attacks."}, {"step": "5", "phase": "Exploit", "description": "[Data Exfiltration] The adversary can obtain sensitive data contained within domain systems or applications."}], "examples": ["Bronze Butler (also known as Tick), has been shown to leverage forged Kerberos Ticket Granting Tickets (TGTs) and Ticket Granting Service (TGS) tickets to maintain administrative access on a number of systems. [REF-584]", "PowerSploit's Invoke-Kerberoast module can be leveraged to request Ticket Granting Service (TGS) tickets and return crackable ticket hashes. [REF-585] [REF-586]"], "related_cwes": ["CWE-522", "CWE-307", "CWE-308", "CWE-309", "CWE-262", "CWE-263", "CWE-654", "CWE-294", "CWE-836"]}, "653": {"name": "Use of Known Operating System Credentials", "abstraction": "Standard", "status": "Draft", "description": "An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System.", "likelihood": "High", "severity": "High", "prerequisites": ["The system/application uses one factor password-based authentication, SSO, and/or cloud-based authentication.", "The system/application does not have a sound password policy that is being enforced.", "The system/application does not implement an effective password throttling mechanism.", "The adversary possesses a list of known user accounts and corresponding passwords that may exist on the target."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Acquire known operating system credentials] The adversary must obtain known operating system credentials in order to access the target system, application, or service within the domain."}, {"step": "2", "phase": "Experiment", "description": "[Attempt authentication] Try each operating system credential against various systems, applications, and services within the domain until the target grants access."}, {"step": "3", "phase": "Exploit", "description": "[Impersonate] An adversary can use successful experiments or authentications to impersonate an authorized user or system, or to laterally move within the network"}, {"step": "4", "phase": "Exploit", "description": "[Spoofing] Malicious data can be injected into the target system or into other systems on the network. The adversary can also pose as a legitimate user to perform social engineering attacks."}, {"step": "5", "phase": "Exploit", "description": "[Data Exfiltration] The adversary can obtain sensitive data contained within system files or application configuration."}], "examples": ["Adversaries exploited the Zoom video conferencing application during the 2020 COVID-19 pandemic to exfiltrate Windows domain credentials from a target system. The attack entailed sending Universal Naming Convention (UNC) paths within the Zoom chat window of an unprotected Zoom call. If the victim cl...", "Mimikatz, a post-exploitation Windows credential harvester, can be used to gather and exploit Windows credentials. This malware has been used in several known cyberattacks, such as the Petya Ransomeware attacks. [REF-576]"], "related_cwes": ["CWE-522", "CWE-307", "CWE-308", "CWE-309", "CWE-262", "CWE-263", "CWE-654"]}, "654": {"name": "Credential Prompt Impersonation", "abstraction": "Detailed", "status": "Stable", "description": "An adversary, through a previously installed malicious application, impersonates a credential prompt in an attempt to steal a user's credentials.", "likelihood": "Medium", "severity": "High", "prerequisites": ["The adversary must already have access to the target system via some means.", "A legitimate task must exist that an adversary can impersonate to glean credentials."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine suitable tasks to exploit] Determine what tasks exist on the target system that may result in a user providing their credentials."}, {"step": "2", "phase": "Exploit", "description": "[Impersonate Task] Impersonate a legitimate task, either expected or unexpected, in an attempt to gain user credentials."}], "examples": ["An adversary monitors the system task list for Microsoft Outlook in an attempt to determine when the application may prompt the user to enter their credentials to view encrypted email. Once the task is executed, the adversary impersonates the credential prompt to obtain the user's Microsoft Outlook ...", "An adversary randomly prompts a user to enter their system credentials, tricking the user into believing that a background process requires the credentials to function. The adversary can then use these gleaned credentials to execute additional attacks or obtain data."], "related_cwes": ["CWE-1021"]}, "655": {"name": "Avoid Security Tool Identification by Adding Data", "abstraction": "Detailed", "status": "Draft", "likelihood": "High", "severity": "High"}, "656": {"name": "Voice Phishing", "abstraction": "Detailed", "status": "Stable", "description": "An adversary targets users with a phishing attack for the purpose of soliciting account passwords or sensitive information from the user. Voice Phishing is a variation of the Phishing social engineering technique where the attack is initiated via a voice call, rather than email. The user is enticed to provide sensitive information by the adversary, who masquerades as a legitimate employee of the alleged organization. Voice Phishing attacks deviate from standard Phishing attacks, in that a user d...", "likelihood": "High", "severity": "High", "prerequisites": ["An adversary needs phone numbers to initiate contact with the victim, in addition to a legitimate-looking telephone number to call the victim from.", "An adversary needs to correctly guess the entity with which the victim does business and impersonate it. Most of the time phishers just use the most popular banks/services and send out their \"hooks\" t...", "An adversary needs to have a sufficiently compelling call to action to prompt the user to take action.", "If passively conducting this attack via a spoofed website, replicated website needs to look extremely similar to the original website and the URL used to get to that website needs to look like the rea..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Obtain domain name and certificate to spoof legitimate site] This optional step can be used to help the adversary impersonate the legitimate organization more convincingly. The adversary can use homo..."}, {"step": "2", "phase": "Explore", "description": "[Explore legitimate website and create duplicate] An adversary optionally creates a website (optionally at a URL that looks similar to the original URL) that closely resembles the organization's websi..."}, {"step": "3", "phase": "Exploit", "description": "[Convince user to provide sensitive information to the adversary.] An adversary \"cold calls\" the victim or receives a call from the victim via the malicious site and provides a call-to-action, in orde..."}, {"step": "4", "phase": "Exploit", "description": "[Use stolen information] Once the adversary obtains the sensitive information, this information can be leveraged to log into the victim's bank account and transfer money to an account of their choice,..."}], "examples": ["The target receives an email or text message stating that their Apple ID has been disabled due to suspicious activity and that the included link includes instructions on how to unlock their Apple account. The link in the text message looks legitimate and once the link is clicked, the user is redirec...", "An adversary calls the target and claims to work for their bank. The adversary informs the target that their bank account has been frozen, due to potential fraudulent spending, and requires authentication in order to re-enable the account. The target, believing the caller is a legitimate bank employ..."]}, "657": {"name": "Malicious Automated Software Update via Spoofing", "abstraction": "Detailed", "status": "Draft", "description": "An attackers uses identify or content spoofing to trick a client into performing an automated software update from a malicious source. A malicious automated software update that leverages spoofing can include content or identity spoofing as well as protocol spoofing. Content or identity spoofing attacks can trigger updates in software by embedding scripted mechanisms within a malicious web page, which masquerades as a legitimate update source. Scripting mechanisms communicate with software compo...", "likelihood": "High", "severity": "High", "examples": ["An example of the spoofing strategy would be the eTrust Antivirus Webscan Automated Update Remote Code Execution vulnerability (CVE-2006-3976) and (CVE-2006-3977) whereby an ActiveX control could be remotely manipulated by an attacker controlled web page to download and execute the attackers' code w..."], "related_cwes": ["CWE-494"]}, "66": {"name": "SQL Injection", "abstraction": "Standard", "status": "Draft", "description": "This attack exploits target software that constructs SQL statements based on user input. An attacker crafts input strings so that when the target software constructs SQL statements based on the input, the resulting SQL statement performs actions other than those the application intended. SQL Injection results from failure of the application to appropriately validate input.", "likelihood": "High", "severity": "High", "prerequisites": ["SQL queries used by the application to store, retrieve or modify data.", "User-controllable input that is not properly validated by the application as part of SQL queries."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey application] The attacker first takes an inventory of the functionality exposed by the application."}, {"step": "2", "phase": "Experiment", "description": "[Determine user-controllable input susceptible to injection] Determine the user-controllable input susceptible to injection. For each user-controllable input that the attacker suspects is vulnerable t..."}, {"step": "3", "phase": "Experiment", "description": "[Experiment with SQL Injection vulnerabilities] After determining that a given input is vulnerable to SQL Injection, hypothesize what the underlying query looks like. Iteratively try to add logic to t..."}, {"step": "4", "phase": "Exploit", "description": "[Exploit SQL Injection vulnerability] After refining and adding various logic to SQL queries, craft and execute the underlying SQL query that will be used to attack the target system. The goal is to r..."}], "examples": ["With PHP-Nuke versions 7.9 and earlier, an attacker can successfully access and modify data, including sensitive contents such as usernames and password hashes, and compromise the application through SQL Injection. The protection mechanism against SQL Injection employs a denylist approach to input v..."], "related_cwes": ["CWE-89", "CWE-1286"]}, "660": {"name": "Root/Jailbreak Detection Evasion via Hooking", "abstraction": "Detailed", "status": "Stable", "description": "An adversary forces a non-restricted mobile application to load arbitrary code or code files, via Hooking, with the goal of evading Root/Jailbreak detection. Mobile device users often Root/Jailbreak their devices in order to gain administrative control over the mobile operating system and/or to install third-party mobile applications that are not provided by authorized application stores (e.g. Google Play Store and Apple App Store). Adversaries may further leverage these capabilities to escalate...", "likelihood": "Medium", "severity": "Very High", "prerequisites": ["The targeted application must be non-restricted to allow code hooking."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify application with attack potential] The adversary searches for and identifies a mobile application that could be exploited for malicious purposes (e.g. banking, voting, or medical application..."}, {"step": "2", "phase": "Experiment", "description": "[Develop code to be hooked into chosen target application] The adversary develops code or leverages existing code that will be hooked into the target application in order to evade Root/Jailbreak detec..."}, {"step": "3", "phase": "Exploit", "description": "[Execute code hooking to evade Root/Jailbreak detection methods] Once hooking code has been developed or obtained, execute the code against the target application to evade Root/Jailbreak detection met..."}], "examples": ["An adversary targets a non-restricted iOS banking application in an attempt to compromise sensitive user data. The adversary creates Objective-C runtime code that always returns \"false\" when checking for the existence of the Cydia application. The malicious code is then dynamically loaded into the a...", "An adversary targets a mobile voting application on an Android device with the goal of committing voter fraud. Leveraging the Xposed framework, the adversary is able to create and hook Java code into the application that bypasses Root detection methods. When the voting application attempts to detect..."], "related_cwes": ["CWE-829"]}, "661": {"name": "Root/Jailbreak Detection Evasion via Debugging", "abstraction": "Detailed", "status": "Stable", "description": "An adversary inserts a debugger into the program entry point of a mobile application to modify the application binary, with the goal of evading Root/Jailbreak detection. Mobile device users often Root/Jailbreak their devices in order to gain administrative control over the mobile operating system and/or to install third-party mobile applications that are not provided by authorized application stores (e.g. Google Play Store and Apple App Store). Rooting/Jailbreaking a mobile device also provides ...", "likelihood": "Medium", "severity": "Very High", "prerequisites": ["A debugger must be able to be inserted into the targeted application."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify application with attack potential] The adversary searches for and identifies a mobile application that could be exploited for malicious purposes (e.g. banking, voting, or medical application..."}, {"step": "2", "phase": "Experiment", "description": "[Debug the target application] The adversary inserts the debugger into the program entry point of the mobile application, after the application's signature has been identified, to dump its memory cont..."}, {"step": "3", "phase": "Experiment", "description": "[Remove application signature verification methods] Remove signature verification methods from the decrypted code and resign the application with a self-signed certificate."}, {"step": "4", "phase": "Exploit", "description": "[Execute the application and evade Root/Jailbreak detection methods] The application executes with the self-signed certificate, while believing it contains a trusted certificate. This now allows the a..."}], "examples": ["An adversary targets an iOS banking application in an attempt to compromise sensitive user data. The adversary launches the application with the iOS debugger and sets a breakpoint at the program entry point, after the application's signature has been verified. Next, the adversary dumps the memory re..."], "related_cwes": ["CWE-489"]}, "662": {"name": "Adversary in the Browser (AiTB)", "abstraction": "Standard", "status": "Stable", "likelihood": "High", "severity": "Very High", "prerequisites": ["The adversary must install or convince a user to install a Trojan.", "There are two components communicating with each other.", "An attacker is able to identify the nature and mechanism of communication between the two target components.", "Strong mutual authentication is not used between the two target components yielding opportunity for adversarial interposition.", "For browser pivoting, the SeDebugPrivilege and a high-integrity process must both exist to execute this attack."], "execution_flow": [{"step": "1", "phase": "Experiment", "description": "The adversary tricks the victim into installing the Trojan Horse malware onto their system."}, {"step": "2", "phase": "Experiment", "description": "The adversary inserts themself into the communication channel initially acting as a routing proxy between the two targeted components."}, {"step": "3", "phase": "Exploit", "description": "The adversary observes, filters, or alters passed data of their choosing to gain access to sensitive information or to manipulate the actions of the two target components for their own purposes."}], "related_cwes": ["CWE-300", "CWE-494"]}, "663": {"name": "Exploitation of Transient Instruction Execution", "abstraction": "Standard", "status": "Stable", "description": "An adversary exploits a hardware design flaw in a CPU implementation of transient instruction execution to expose sensitive data and bypass/subvert access control over restricted resources. Typically, the adversary conducts a covert channel attack to target non-discarded microarchitectural changes caused by transient executions such as speculative execution, branch prediction, instruction pipelining, and/or out-of-order execution. The transient execution results in a series of instructions (gadg...", "likelihood": "Low", "severity": "Very High", "prerequisites": ["The adversary needs at least user execution access to a system and a maliciously crafted program/application/process with unprivileged code to misuse transient instruction set execution of the CPU."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey target application and relevant OS shared code libraries] Adversary identifies vulnerable transient instruction sets and the code/function calls to trigger them as well as instruction sets or ..."}, {"step": "2", "phase": "Explore", "description": "[Explore cache and identify impacts] Utilize tools to understand the impact of transient instruction execution upon address spaces and CPU operations."}, {"step": "1", "phase": "Experiment", "description": "[Cause conditions for identified transient instruction set execution] Adversary ensures that specific code/instructions of the target process are executed by CPU, so desired transient instructions are..."}, {"step": "2", "phase": "Experiment", "description": "[Cause specific secret data to be cached from restricted address space] Executed instruction sets (gadgets) in target address space, initially executed via adversary-chosen transient instructions sets..."}, {"step": "1", "phase": "Exploit", "description": "[Perform covert channel attack to obtain/access secret data] Adversary process code removes instructions/data from shared cache set, waits for target process to reinsert them back into cache, to ident..."}], "related_cwes": ["CWE-1037", "CWE-1303", "CWE-1264"]}, "664": {"name": "Server Side Request Forgery", "abstraction": "Standard", "status": "Stable", "likelihood": "High", "severity": "High", "prerequisites": ["Server must be running a web application that processes HTTP requests."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find target application] Find target web application that accepts a user input and retrieves data from the server"}, {"step": "2", "phase": "Experiment", "description": "[Examine existing application requests] Examine HTTP/GET requests to view the URL query format. Adversaries test to see if this type of attack is possible through weaknesses in an application's protec..."}, {"step": "3", "phase": "Exploit", "description": "[Malicious request] Adversary crafts a malicious URL request that assumes the privilege level of the server to query internal or external network services and sends the request to the application"}], "related_cwes": ["CWE-918", "CWE-20"]}, "665": {"name": "Exploitation of Thunderbolt Protection Flaws", "abstraction": "Detailed", "status": "Stable", "likelihood": "Low", "severity": "Very High", "prerequisites": ["The adversary needs at least a few minutes of physical access to a system with an open Thunderbolt port, version 3 or lower, and an external thunderbolt device controlled by the adversary with malicio..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey physical victim environment and potential Thunderbolt system targets] The adversary monitors the target's physical environment to identify systems with Thunderbolt interfaces, identify potenti..."}, {"step": "2", "phase": "Explore", "description": "[Evaluate the target system and its Thunderbolt interface] The adversary determines the device's operating system, Thunderbolt interface version, and any implemented Thunderbolt protections to plan th..."}, {"step": "1", "phase": "Experiment", "description": "[Obtain and/or clone firmware image] The adversary physically manipulates Thunderbolt enabled devices to acquire the firmware image from the target and/or adversary Thunderbolt host controller's SPI (..."}, {"step": "2", "phase": "Experiment", "description": "[Parse and locate relevant firmware data structures and information based upon Thunderbolt controller model, firmware version, and other information] The acquired victim and/or adversary firmware imag..."}, {"step": "3", "phase": "Experiment", "description": "[Disable Thunderbolt security and prevent future Thunderbolt security modifications (if necessary)] The adversary overrides the target device's Thunderbolt Security Level to \"None\" (SL0) and/or enable..."}, {"step": "4", "phase": "Experiment", "description": "[Modify/replace victim Thunderbolt firmware image] The modified victim and/or adversary thunderbolt firmware image is written to attacker SPI flash."}, {"step": "1", "phase": "Exploit", "description": "[Connect adversary-controlled thunderbolt enabled device to victim device and verify successful execution of malicious actions] The adversary needs to determine if their exploitation of selected vulne..."}, {"step": "2", "phase": "Exploit", "description": "[Exfiltration of desired data from victim device to adversary device] Utilize PCIe tunneling to transfer desired data and information from victim device across Thunderbolt connection."}], "related_cwes": ["CWE-345", "CWE-353", "CWE-288", "CWE-1188", "CWE-862"]}, "666": {"name": "BlueSmacking", "abstraction": "Standard", "status": "Draft", "description": "An adversary uses Bluetooth flooding to transfer large packets to Bluetooth enabled devices over the L2CAP protocol with the goal of creating a DoS. This attack must be carried out within close proximity to a Bluetooth enabled device.", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["The system/application has Bluetooth enabled."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Scan for Bluetooth Enabled Devices] Using BlueZ along with an antenna, an adversary searches for devices with Bluetooth on."}, {"step": "2", "phase": "Experiment", "description": "[Change L2CAP Packet Length] The adversary must change the L2CAP packet length to create packets that will overwhelm a Bluetooth enabled device."}, {"step": "3", "phase": "Exploit", "description": "[Flood] An adversary sends the packets to the target device, and floods it until performance is degraded."}], "related_cwes": ["CWE-404"]}, "667": {"name": "Bluetooth Impersonation AttackS (BIAS)", "abstraction": "Detailed", "status": "Draft", "description": "An adversary disguises the MAC address of their Bluetooth enabled device to one for which there exists an active and trusted connection and authenticates successfully. The adversary can then perform malicious actions on the target Bluetooth device depending on the target\u2019s capabilities.", "likelihood": "Medium", "severity": "High", "prerequisites": ["Knowledge of a target device's list of trusted connections."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find disguise and target] The adversary starts the Bluetooth service on the attacking device and searches for nearby listening devices."}, {"step": "2", "phase": "Experiment", "description": "[Disguise] Using the MAC address of the device the adversary wants to impersonate, they may use a tool such as spooftooth or macchanger to spoof their Bluetooth address and attempt to authenticate wit..."}, {"step": "3", "phase": "Exploit", "description": "[Use device capabilities to accomplish goal] Finally, if authenticated successfully the adversary can perform tasks/information gathering dependent on the target's capabilities and connections."}], "related_cwes": ["CWE-290"]}, "668": {"name": "Key Negotiation of Bluetooth Attack (KNOB)", "abstraction": "Standard", "status": "Draft", "description": "An adversary can exploit a flaw in Bluetooth key negotiation allowing them to decrypt information sent between two devices communicating via Bluetooth. The adversary uses an Adversary in the Middle setup to modify packets sent between the two devices during the authentication process, specifically the entropy bits. Knowledge of the number of entropy bits will allow the attacker to easily decrypt information passing over the line of communication.", "likelihood": "Low", "severity": "High", "prerequisites": ["Person in the Middle network setup."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Discovery] Using an established Person in the Middle setup, search for Bluetooth devices beginning the authentication process."}, {"step": "2", "phase": "Experiment", "description": "[Change the entropy bits] Upon recieving the initial key negotiation packet from the master, the adversary modifies the entropy bits requested to 1 to allow for easy decryption before it is forwarded."}, {"step": "3", "phase": "Exploit", "description": "[Capture and decrypt data] Once the entropy of encryption is known, the adversary can capture data and then decrypt on their device."}], "examples": ["Given users Alice, Bob and Charlie (Charlie being the attacker), Alice and Bob begin to agree on an encryption key when connecting. While Alice sends a message to Bob that an encryption key with 16 bytes of entropy should be used, Charlie changes this to 1 and forwards the request to Bob and continu..."], "related_cwes": ["CWE-425", "CWE-285", "CWE-693"]}, "669": {"name": "Alteration of a Software Update", "abstraction": "Standard", "status": "Draft", "likelihood": "Medium", "severity": "High", "prerequisites": ["An adversary would need to have penetrated an organization\u2019s software update infrastructure including gaining access to components supporting the configuration management of software versions and upda..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify software with frequent updates] The adversary must first identify a target software that has updates at least with some frequency, enough that there is am update infrastructure."}, {"step": "2", "phase": "Experiment", "description": "[Gain access to udpate infrastructure] The adversary must then gain access to the organization's software update infrastructure. This can either be done by gaining remote access from outside the organ..."}, {"step": "3", "phase": "Exploit", "description": "[Alter the software update] Through access to the software update infrastructure, an adversary will alter the software update by injecting malware into the content of an outgoing update."}]}, "67": {"name": "String Format Overflow in syslog()", "abstraction": "Detailed", "status": "Draft", "description": "This attack targets applications and software that uses the syslog() function insecurely. If an application does not explicitely use a format string parameter in a call to syslog(), user input can be placed in the format string parameter leading to a format string injection attack. Adversaries can then inject malicious format string commands into the function call leading to a buffer overflow. There are many reported software vulnerabilities with the root cause being a misuse of the syslog() fun...", "likelihood": "High", "severity": "Very High", "prerequisites": ["The Syslog function is used without specifying a format string argument, allowing user input to be placed direct into the function call as a format string."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target application] The adversary identifies a target application or program to perform the buffer overflow on. In this attack, adversaries look for applications that use syslog() incorrectl..."}, {"step": "2", "phase": "Experiment", "description": "[Find injection vector] The adversary identifies an injection vector to deliver the excessive content to the targeted application's buffer. For each user-controllable input that the adversary suspects..."}, {"step": "3", "phase": "Experiment", "description": "[Craft overflow content] The adversary crafts the content to be injected. If the intent is to simply cause the software to crash, the content need only consist of an excessive quantity of random data...."}, {"step": "4", "phase": "Exploit", "description": "[Overflow the buffer] Using the injection vector, the adversary supplies the program with the crafted format string injection, causing a buffer."}], "examples": ["Format string vulnerability in TraceEvent function for ntop before 2.1 allows remote adversaries to execute arbitrary code by causing format strings to be injected into calls to the syslog function, via (1) an HTTP GET request, (2) a user name in HTTP authentication, or (3) a password in HTTP authen..."], "related_cwes": ["CWE-120", "CWE-134", "CWE-74", "CWE-20", "CWE-680", "CWE-697"]}, "670": {"name": "Software Development Tools Maliciously Altered", "abstraction": "Detailed", "status": "Draft", "description": "An adversary with the ability to alter tools used in a development environment causes software to be developed with maliciously modified tools. Such tools include requirements management and database tools, software design tools, configuration management tools, compilers, system build tools, and software performance testing and load testing tools. The adversary then carries out malicious acts once the software is deployed including malware infection of other systems to support further compromise...", "likelihood": "Low", "severity": "High", "prerequisites": ["An adversary would need to have access to a targeted developer\u2019s development environment and in particular to tools used to design, create, test and manage software, where the adversary could ensure m..."], "examples": ["An adversary with access to software build tools inside an Integrated Development Environment IDE alters a script used for downloading dependencies from a dependent code repository where the script has been changed to include malicious code implanted in the repository by the adversary."]}, "671": {"name": "Requirements for ASIC Functionality Maliciously Altered", "abstraction": "Detailed", "status": "Draft", "description": "An adversary with access to functional requirements for an application specific integrated circuit (ASIC), a chip designed/customized for a singular particular use, maliciously alters requirements derived from originating capability needs. In the chip manufacturing process, requirements drive the chip design which, when the chip is fully manufactured, could result in an ASIC which may not meet the user\u2019s needs, contain malicious functionality, or exhibit other anomalous behaviors thereby affecti...", "likelihood": "Low", "severity": "High", "prerequisites": ["An adversary would need to have access to a foundry\u2019s or chip maker\u2019s requirements management system that stores customer requirements for ASICs, requirements upon which the design of the ASIC is base..."], "examples": ["An adversary with access to ASIC functionality requirements for various customers, targets a particular customer\u2019s ordered lot of ASICs by altering its functional requirements such that the ASIC design will result in a manufactured chip that does not meet the customer\u2019s capability needs."]}, "672": {"name": "Malicious Code Implanted During Chip Programming", "abstraction": "Detailed", "status": "Draft", "likelihood": "Low", "severity": "High", "prerequisites": ["An adversary would need to have access to a foundry\u2019s or chip maker\u2019s development/production environment where programs for specific chips are developed, managed and uploaded into targeted chips prior..."]}, "673": {"name": "Developer Signing Maliciously Altered Software", "abstraction": "Detailed", "status": "Draft", "likelihood": "Medium", "severity": "High", "prerequisites": ["An adversary would need to have access to a targeted developer\u2019s software development environment, including to their software build processes, where the adversary could ensure code maliciously tainte..."]}, "674": {"name": "Design for FPGA Maliciously Altered", "abstraction": "Detailed", "status": "Stable", "likelihood": "Low", "severity": "High", "prerequisites": ["An adversary would need to have access to FPGA programming/configuration-related systems in a chip maker\u2019s development environment where FPGAs can be initially configured prior to delivery to a custom..."]}, "675": {"name": "Retrieve Data from Decommissioned Devices", "abstraction": "Standard", "status": "Stable", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["An adversary needs to have access to electronic data processing equipment being recycled or disposed of (e.g., laptops, servers) at a collection location and the ability to take control of it for the ..."], "related_cwes": ["CWE-1266"]}, "676": {"name": "NoSQL Injection", "abstraction": "Standard", "status": "Stable", "likelihood": "High", "severity": "High", "prerequisites": ["Awareness of the technology stack being leveraged by the target application.", "NoSQL queries used by the application to store, retrieve, or modify data.", "User-controllable input that is not properly validated by the application as part of NoSQL queries.", "Target potentially susceptible to operator replacement attacks."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey target application] Due to the number of NoSQL databases available and the numerous language/API combinations of each, the adversary must first survey the target application to learn what tech..."}, {"step": "2", "phase": "Experiment", "description": "[Identify user-controllable input susceptible to injection] After identifying the technology stack being used and where user-driven input is leveraged, determine the user-controllable input susceptibl..."}, {"step": "3", "phase": "Experiment", "description": "[Experiment with NoSQL Injection vulnerabilities] After determining that a given input is vulnerable to NoSQL Injection, hypothesize what the underlying query looks like. Iteratively try to add logic ..."}, {"step": "4", "phase": "Exploit", "description": "[Exploit NoSQL Injection vulnerability] After refining and adding various logic to NoSQL queries, craft and execute the underlying NoSQL query that will be used to attack the target system."}], "related_cwes": ["CWE-943", "CWE-1286"]}, "677": {"name": "Server Motherboard Compromise", "abstraction": "Detailed", "status": "Draft", "likelihood": "Low", "severity": "High", "prerequisites": ["An adversary with access to hardware/software processes and tools within the development or hardware/software support environment can insert malicious software into hardware components during developm..."]}, "678": {"name": "System Build Data Maliciously Altered", "abstraction": "Detailed", "status": "Draft", "likelihood": "Low", "severity": "High", "prerequisites": ["An adversary has access to the data files and processes used for executing system configuration and performing the build."]}, "679": {"name": "Exploitation of Improperly Configured or Implemented Memory Protections", "abstraction": "Detailed", "status": "Draft", "likelihood": "Medium", "severity": "Very High", "prerequisites": ["Access to the hardware being leveraged."], "related_cwes": ["CWE-1222", "CWE-1252", "CWE-1257", "CWE-1260", "CWE-1274", "CWE-1282", "CWE-1312", "CWE-1316", "CWE-1326"]}, "68": {"name": "Subvert Code-signing Facilities", "abstraction": "Standard", "status": "Draft", "description": "Many languages use code signing facilities to vouch for code's identity and to thus tie code to its assigned privileges within an environment. Subverting this mechanism can be instrumental in an attacker escalating privilege. Any means of subverting the way that a virtual machine enforces code signing classifies for this style of attack.", "likelihood": "Low", "severity": "Very High", "prerequisites": ["A framework-based language that supports code signing (such as, and most commonly, Java or .NET)", "Deployed code that has been signed by its authoring vendor, or a partner.", "The attacker will, for most circumstances, also need to be able to place code in the victim container. This does not necessarily mean that they will have to subvert host-level security, except when ex..."], "examples": ["In old versions (prior to 3.0b4) of the Netscape web browser Attackers able to foist a malicious Applet into a client's browser could execute the \"Magic Coat\" attack. In this attack, the offending Applet would implement its own getSigners() method. This implementation would use the containing VM's A...", "Some (older) web browsers allowed scripting languages, such as JavaScript, to call signed Java code. In these circumstances, the browser's VM implementation would choose not to conduct stack inspection across language boundaries (from called signed Java to calling JavaScript) and would short-circuit...", "The ability to load unsigned code into the kernel of earlier versions of Vista and bypass integrity checking is an example of such subversion. In the proof-of-concept, it is possible to bypass the signature-checking mechanism Vista uses to load device drivers."], "related_cwes": ["CWE-325", "CWE-328", "CWE-1326"]}, "680": {"name": "Exploitation of Improperly Controlled Registers", "abstraction": "Detailed", "status": "Draft", "likelihood": "Medium", "severity": "High", "prerequisites": ["Awareness of the hardware being leveraged.", "Access to the hardware being leveraged."], "related_cwes": ["CWE-1224", "CWE-1231", "CWE-1233", "CWE-1262", "CWE-1283"]}, "681": {"name": "Exploitation of Improperly Controlled Hardware Security Identifiers", "abstraction": "Detailed", "status": "Draft", "likelihood": "Medium", "severity": "Very High", "prerequisites": ["Awareness of the hardware being leveraged.", "Access to the hardware being leveraged."], "related_cwes": ["CWE-1259", "CWE-1267", "CWE-1270", "CWE-1294", "CWE-1302"]}, "682": {"name": "Exploitation of Firmware or ROM Code with Unpatchable Vulnerabilities", "abstraction": "Standard", "status": "Draft", "description": "An adversary may exploit vulnerable code (i.e., firmware or ROM) that is unpatchable. Unpatchable devices exist due to manufacturers intentionally or inadvertently designing devices incapable of updating their software. Additionally, with updatable devices, the manufacturer may decide not to support the device and stop making updates to their software.", "likelihood": "Medium", "severity": "High", "prerequisites": ["Awareness of the hardware being leveraged.", "Access to the hardware being leveraged, either physically or remotely."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine vulnerable firmware or ROM code] An adversary will attempt to find device models that are known to have unpatchable firmware or ROM code, or are deemed \u201cend-of-support\u201d where a patch will n..."}, {"step": "2", "phase": "Experiment", "description": "[Determine plan of attack] An adversary identifies a specific device/model that they wish to attack. They will also investigate similar devices to determine if the vulnerable firmware or ROM code is a..."}, {"step": "3", "phase": "Exploit", "description": "[Carry out attack] An adversary exploits the vulnerable firmware or ROM code on the identified device(s) to achieve their desired goal."}], "related_cwes": ["CWE-1277", "CWE-1310"]}, "69": {"name": "Target Programs with Elevated Privileges", "abstraction": "Standard", "status": "Draft", "description": "This attack targets programs running with elevated privileges. The adversary tries to leverage a vulnerability in the running program and get arbitrary code to execute with elevated privileges.", "likelihood": "High", "severity": "Very High", "prerequisites": ["The targeted program runs with elevated OS privileges.", "The targeted program accepts input data from the user or from another program.", "The targeted program is giving away information about itself. Before performing such attack, an eventual attacker may need to gather information about the services running on the host target. The more...", "This attack often requires communicating with the host target services directly. For instance Telnet may be enough to communicate with the host target."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find programs with elevated priveleges] The adversary probes for programs running with elevated privileges."}, {"step": "2", "phase": "Explore", "description": "[Find vulnerability in running program] The adversary looks for a vulnerability in the running program that would allow for arbitrary code execution with the privilege of the running program."}, {"step": "3", "phase": "Exploit", "description": "[Execute arbitrary code] The adversary exploits the vulnerability that they have found. For instance, they can try to inject and execute arbitrary code or write to OS resources."}], "related_cwes": ["CWE-250", "CWE-15"]}, "690": {"name": "Metadata Spoofing", "abstraction": "Meta", "status": "Stable", "likelihood": "Medium", "severity": "High", "prerequisites": ["Identification of a resource whose metadata is to be spoofed"]}, "691": {"name": "Spoof Open-Source Software Metadata", "abstraction": "Standard", "status": "Stable", "likelihood": "Medium", "severity": "High", "prerequisites": ["Identification of a popular open-source component whose metadata is to be spoofed."], "examples": ["An adversary provides a malicious open-source library, claiming to provide extended logging features and functionality, and spoofs the metadata with that of a widely used legitimate library. The adversary then tricks victims into including this library in their underlying application. Once the malic..."], "related_cwes": ["CWE-494"]}, "692": {"name": "Spoof Version Control System Commit Metadata", "abstraction": "Detailed", "status": "Stable", "likelihood": "Medium", "severity": "High", "prerequisites": ["Identification of a popular open-source repository whose metadata is to be spoofed."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target] The adversary must first identify a target repository for them to spoof. Typically, this will be a popular and widely used repository, as to increase the amount of victims a successf..."}, {"step": "2", "phase": "Experiment", "description": "[Create malicious repository] The adversary must create a malicious repository that imitates the legitimate repository being spoofed. This may include creating a username that closely matches the legi..."}, {"step": "3", "phase": "Experiment", "description": "[Spoof commit metadata] Once the malicious repository has been created, the adversary must then spoof the commit metadata to make the repository appear to be frequently maintained and originating from..."}, {"step": "4", "phase": "Exploit", "description": "[Exploit victims] The adversary infiltrates software and/or system environments with the goal of conducting additional attacks."}], "examples": ["In July 2022, Checkmarx reported that GitHub commit metadata could be spoofed if unsigned commits were leveraged by the repository. Adversaries were able to spoof commit contributors, as well as the date/time of the commit. This resulted in commits appearing to originate from trusted developers and ..."], "related_cwes": ["CWE-494"]}, "693": {"name": "StarJacking", "abstraction": "Detailed", "status": "Stable", "likelihood": "Medium", "severity": "High", "prerequisites": ["Identification of a popular open-source package whose popularity metadata is to be used for the malicious package."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target] The adversary must first identify a target package whose popularity statistics will be leveraged. This will be a popular and widely used package, as to increase the perceived pedigre..."}, {"step": "2", "phase": "Experiment", "description": "[Spoof package popularity] The adversary provides their malicious package to a package manager and uses the source code repository URL identified in Step 1 to spoof the popularity of the package. This..."}, {"step": "3", "phase": "Exploit", "description": "[Exploit victims] The adversary infiltrates development environments with the goal of conducting additional attacks."}], "examples": ["In April 2022, Checkmarx reported that packages hosted on NPM, PyPi, and Yarn do not properly validate that the provided GitHub repository URL actually pertains to the package being provided. Combined with additional attacks such as TypoSquatting, this allows adversaries to spoof popularity metadata..."], "related_cwes": ["CWE-494"]}, "694": {"name": "System Location Discovery", "abstraction": "Standard", "status": "Stable", "likelihood": "High", "severity": "Very Low", "prerequisites": ["The adversary must have some level of access to the system and have a basic understanding of the operating system in order to query the appropriate sources for relevant information."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[System Locale Information Discovery] The adversary examines system information from various sources such as registry and native API functions and correlates the gathered information to infer the geog..."}], "related_cwes": ["CWE-497"]}, "695": {"name": "Repo Jacking", "abstraction": "Detailed", "status": "Stable", "likelihood": "Medium", "severity": "High", "prerequisites": ["Identification of a popular repository that may be directly referenced in numerous software applications", "A repository owner/maintainer who has recently changed their username or deleted their account"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target] The adversary must first identify a target repository that is commonly used and whose owner/maintainer has either changed/deleted their username or transferred ownership of the repos..."}, {"step": "2", "phase": "Experiment", "description": "[Recreate initial repository path] The adversary re-registers the account that was renamed/deleted by the target repository's owner/maintainer and recreates the target repository with malicious code i..."}, {"step": "3", "phase": "Exploit", "description": "[Exploit victims] The adversary's malicious code is incorporated into applications that directly reference the initial repository, which further allows the adversary to conduct additional attacks."}], "related_cwes": ["CWE-494", "CWE-829"]}, "696": {"name": "Load Value Injection", "abstraction": "Detailed", "status": "Draft", "description": "An adversary exploits a hardware design flaw in a CPU implementation of transient instruction execution in which a faulting or assisted load instruction transiently forwards adversary-controlled data from microarchitectural buffers. By inducing a page fault or microcode assist during victim execution, an adversary can force legitimate victim execution to operate on the adversary-controlled data which is stored in the microarchitectural buffers. The adversary can then use existing code gadgets an...", "likelihood": "Low", "severity": "Very High", "prerequisites": ["The adversary needs at least user execution access to a system and a maliciously crafted program/application/process with unprivileged code to misuse transient instruction set execution of the CPU.", "The CPU incorrectly transiently forwards values from microarchitectural buffers after faulting or assisted loads", "The adversary needs the ability to induce page faults or microcode assists on the target system.", "Code gadgets exist that allow the adversary to hijack transient execution and encode secrets into the microarchitectural state."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey target application and relevant OS shared code libraries] Adversary identifies vulnerable transient instruction sets and the code/function calls to trigger them as well as instruction sets or ..."}, {"step": "2", "phase": "Experiment", "description": "[Fill microarchitectural buffer with controlled value] The adversary will utilize the found code gadget from the previous step to load a value into a microarchitectural buffer."}, {"step": "3", "phase": "Experiment", "description": "[Set up instruction to page fault or microcode assist] The adversary must manipulate the system such that a page fault or microcode assist occurs when a valid instruction is run. If the instruction th..."}, {"step": "4", "phase": "Exploit", "description": "[Operate on adversary-controlled data] Once the attack has been set up and the page fault or microcode assist occurs, the system operates on the adversary-controlled data."}], "related_cwes": ["CWE-1342"]}, "697": {"name": "DHCP Spoofing", "abstraction": "Standard", "status": "Stable", "likelihood": "Low", "severity": "High", "prerequisites": ["The adversary must have access to a machine within the target LAN which can send DHCP offers to the target."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine Exsisting DHCP lease] An adversary observes network traffic and waits for an existing DHCP lease to expire on a target machine in the LAN."}, {"step": "2", "phase": "Experiment", "description": "[Capture the DHCP DISCOVER message] The adversary captures \"DISCOVER\" messages and crafts \"OFFER\" responses for the identified target MAC address. The success of this attack centers on the capturing o..."}, {"step": "3", "phase": "Exploit", "description": "[Compromise Network Access and Collect Network Activity] An adversary successfully acts as a rogue DHCP server by redirecting legitimate DHCP requests to itself."}], "examples": ["In early 2019, Microsoft patched a critical vulnerability (CVE-2019-0547) in the Windows DHCP client which allowed remote code execution via crafted DHCP OFFER packets. [REF-739]"], "related_cwes": ["CWE-923"]}, "698": {"name": "Install Malicious Extension", "abstraction": "Detailed", "status": "Stable", "likelihood": "Medium", "severity": "High", "prerequisites": ["The adversary must craft malware based on the type of software and system(s) they intend to exploit.", "If the adversary intends to install the malicious extension themself, they must first compromise the target machine via some other means."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target(s)] The adversary must first identify target software that allows for extensions/plugins and which they wish to exploit, such as a web browser or desktop application. To increase the ..."}, {"step": "2", "phase": "Experiment", "description": "[Create malicious extension] Having identified a suitable target, the adversary crafts a malicious extension/plugin that can be installed by the underlying target software. This malware may be targete..."}, {"step": "3", "phase": "Exploit", "description": "[Install malicious extension] The malicious extension/plugin is installed by the underlying target software and executes the adversary-created malware, resulting in a variety of negative technical imp..."}], "related_cwes": ["CWE-507", "CWE-829"]}, "699": {"name": "Eavesdropping on a Monitor", "abstraction": "Meta", "status": "Draft", "description": "An Adversary can eavesdrop on the content of an external monitor through the air without modifying any cable or installing software, just capturing this signal emitted by the cable or video port, with this the attacker will be able to impact the confidentiality of the data without being detected by traditional security tools", "likelihood": "Medium", "severity": "High", "prerequisites": ["Victim should use an external monitor device", "Physical access to the target location and devices"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey Target] The adversary surveys the target location, looking for exposed display cables and locations to hide an SDR. This also includes looking for display cables or monitors placed close to a ..."}, {"step": "2", "phase": "Experiment", "description": "[Find target using SDR] The adversary sets up an SDR near the target display cable or monitor. They use the SDR software to locate the corresponding frequency of the display cable. This is done by loo..."}, {"step": "3", "phase": "Exploit", "description": "[Visualize Monitor Image] Once the SDR software has been used to identify the target, the adversary will record the transmissions and visualize the monitor image using these transmissions, which allow..."}], "related_cwes": ["CWE-1300"]}, "7": {"name": "Blind SQL Injection", "abstraction": "Detailed", "status": "Draft", "description": "Blind SQL Injection results from an insufficient mitigation for SQL Injection. Although suppressing database error messages are considered best practice, the suppression alone is not sufficient to prevent SQL Injection. Blind SQL Injection is a form of SQL Injection that overcomes the lack of error messages. Without the error messages that facilitate SQL Injection, the adversary constructs input strings that probe the target through simple Boolean SQL expressions. The adversary can determine if ...", "likelihood": "High", "severity": "High", "prerequisites": ["SQL queries used by the application to store, retrieve or modify data.", "User-controllable input that is not properly validated by the application as part of SQL queries."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Hypothesize SQL queries in application]"}, {"step": "2", "phase": "Explore", "description": "[Determine how to inject information into the queries]"}, {"step": "3", "phase": "Experiment", "description": "[Determine user-controllable input susceptible to injection] Determine the user-controllable input susceptible to injection. For each user-controllable input that the adversary suspects is vulnerable ..."}, {"step": "4", "phase": "Experiment", "description": "[Determine database type] Determines the type of the database, such as MS SQL Server or Oracle or MySQL, using logical conditions as part of the injected queries"}, {"step": "5", "phase": "Exploit", "description": "[Extract information about database schema] Extract information about database schema by getting the database to answer yes/no questions about the schema."}, {"step": "6", "phase": "Exploit", "description": "[Exploit SQL Injection vulnerability] Use the information obtained in the previous steps to successfully inject the database in order to bypass checks or modify, add, retrieve or delete data from the ..."}], "examples": ["In the PHP application TimeSheet 1.1, an adversary can successfully retrieve username and password hashes from the database using Blind SQL Injection. If the adversary is aware of the local path structure, the adversary can also remotely execute arbitrary code and write the output of the injected qu..."], "related_cwes": ["CWE-89", "CWE-209", "CWE-74", "CWE-20", "CWE-697", "CWE-707"]}, "70": {"name": "Try Common or Default Usernames and Passwords", "abstraction": "Detailed", "status": "Draft", "description": "An adversary may try certain common or default usernames and passwords to gain access into the system and perform unauthorized actions. An adversary may try an intelligent brute force using empty passwords, known vendor default credentials, as well as a dictionary of common usernames and passwords. Many vendor products come preconfigured with default (and thus well-known) usernames and passwords that should be deleted prior to usage in a production environment. It is a common mistake to forget t...", "likelihood": "Medium", "severity": "High", "prerequisites": ["The system uses one factor password based authentication.The adversary has the means to interact with the system."], "examples": ["A user sets their password to \"123\" or intentionally leaves their password blank. If the system does not have password strength enforcement against a sound password policy, this password may be admitted. Passwords like these two examples are two simple and common passwords that are easily able to be...", "Cisco 2700 Series Wireless Location Appliances (version 2.1.34.0 and earlier) have a default administrator username \"root\" with a password \"password\". This allows remote attackers to easily obtain administrative privileges. See also: CVE-2006-5288", "In April 2019, adversaries attacked several popular IoT devices (a VOIP phone, an office printer, and a video decoder) across multiple customer locations. An investigation conducted by the Microsoft Security Resposne Center (MSRC) discovered that these devices were used to gain initial access to cor..."], "related_cwes": ["CWE-521", "CWE-262", "CWE-263", "CWE-798", "CWE-654", "CWE-308", "CWE-309"]}, "700": {"name": "Network Boundary Bridging", "abstraction": "Standard", "status": "Draft", "description": "An adversary which has gained elevated access to network boundary devices may use these devices to create a channel to bridge trusted and untrusted networks. Boundary devices do not necessarily have to be on the network\u2019s edge, but rather must serve to segment portions of the target network the adversary wishes to cross into.", "likelihood": "Medium", "severity": "High", "prerequisites": ["The adversary must have control of a network boundary device."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify potential targets] An adversary identifies network boundary devices that can be compromised."}, {"step": "2", "phase": "Experiment", "description": "[Compromise targets] The adversary must compromise the identified targets in the previous step."}, {"step": "3", "phase": "Exploit", "description": "[Bridge Networks] The adversary changes the configuration of the compromised network device to connect the networks the device was segmenting. Depending on the type of network boundary device and its ..."}]}, "701": {"name": "Browser in the Middle (BiTM)", "abstraction": "Standard", "status": "Draft", "description": "An adversary exploits the inherent functionalities of a web browser, in order to establish an unnoticed remote desktop connection in the victim's browser to the adversary's system. The adversary must deploy a web client with a remote desktop session that the victim can access.", "likelihood": "Medium", "severity": "High", "prerequisites": ["The adversary must create a convincing web client to establish the connection. The victim then needs to be lured onto the adversary's webpage. In addition, the victim's machine must not use local auth..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify potential targets] The adversary identifies an application or service that the target is likely to use."}, {"step": "2", "phase": "Experiment", "description": "[Lure victims] The adversary crafts a phishing campaign to lure unsuspecting victims into using the transparent browser."}, {"step": "3", "phase": "Exploit", "description": "[Monitor and Manipulate Data] When the victim establishes the connection to the transparent browser, the adversary can view victim activity and make alterations to what the victim sees when browsing t..."}], "related_cwes": ["CWE-294", "CWE-345"]}, "702": {"name": "Exploiting Incorrect Chaining or Granularity of Hardware Debug Components", "abstraction": "Detailed", "status": "Draft", "likelihood": "Low", "severity": "Medium", "prerequisites": ["Hardware device has an exposed debug interface"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Find and scan debug interface] The adversary must first find and scan a debug interface to determine what they are authorized to use and what devices are chained to that interface."}, {"step": "2", "phase": "Experiment", "description": "[Connect to debug interface] The adversary next connects a device to the JTAG interface using the properties found in the explore phase so that they can send commands. The adversary sends some test co..."}, {"step": "3", "phase": "Exploit", "description": "[Move along debug chain] Once the adversary has connected to the main TAP, or JTAG interface, they will move along the TAP chain to see what debug interfaces might be available on that chain."}], "related_cwes": ["CWE-1296"]}, "71": {"name": "Using Unicode Encoding to Bypass Validation Logic", "abstraction": "Detailed", "status": "Draft", "description": "An attacker may provide a Unicode string to a system component that is not Unicode aware and use that to circumvent the filter or cause the classifying mechanism to fail to properly understanding the request. That may allow the attacker to slip malicious data past the content filter and/or possibly cause the application to route the request incorrectly.", "likelihood": "Medium", "severity": "High", "prerequisites": ["Filtering is performed on data that has not be properly canonicalized."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser or an automated tool, an attacker follows all public links and actions on a web site. They record all the links, the forms, the re..."}, {"step": "2", "phase": "Experiment", "description": "[Probe entry points to locate vulnerabilities] The attacker uses the entry points gathered in the \"Explore\" phase as a target list and injects various Unicode encoded payloads to determine if an entry..."}], "related_cwes": ["CWE-176", "CWE-179", "CWE-180", "CWE-173", "CWE-172", "CWE-184", "CWE-183", "CWE-74", "CWE-20", "CWE-697", "CWE-692"]}, "72": {"name": "URL Encoding", "abstraction": "Detailed", "status": "Draft", "description": "This attack targets the encoding of the URL. An adversary can take advantage of the multiple way of encoding an URL and abuse the interpretation of the URL.", "likelihood": "High", "severity": "High", "prerequisites": ["The application should accepts and decodes URL input.", "The application performs insufficient filtering/canonicalization on the URLs."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey web application for URLs with parameters] Using a browser, an automated tool or by inspecting the application, an adversary records all URLs that contain parameters."}, {"step": "2", "phase": "Experiment", "description": "[Probe URLs to locate vulnerabilities] The adversary uses the URLs gathered in the \"Explore\" phase as a target list and tests parameters with different encodings of special characters to see how the w..."}, {"step": "3", "phase": "Exploit", "description": "[Inject special characters into URL parameters] Using the information gathered in the \"Experiment\" phase, the adversary injects special characters into the URL using URL encoding. This can lead to pat..."}], "related_cwes": ["CWE-173", "CWE-177", "CWE-172", "CWE-73", "CWE-74", "CWE-20"]}, "73": {"name": "User-Controlled Filename", "abstraction": "Standard", "status": "Draft", "description": "An attack of this type involves an adversary inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect...", "likelihood": "High", "severity": "High", "prerequisites": ["The victim must trust the name and locale of user controlled filenames."], "examples": ["Phishing attacks rely on a user clicking on links on that are supplied to them by attackers masquerading as a trusted resource such as a bank or online auction site. The end user's email client hosts the supplied resource name in this case via email. The resource name, however may either 1) direct t..."], "related_cwes": ["CWE-20", "CWE-184", "CWE-96", "CWE-348", "CWE-116", "CWE-350", "CWE-86", "CWE-697"]}, "74": {"name": "Manipulating State", "abstraction": "Meta", "status": "Stable", "likelihood": "Medium", "severity": "High", "prerequisites": ["User state is maintained at least in some way in user-controllable locations, such as cookies or URL parameters.", "There is a faulty finite state machine in the hardware logic that can be exploited."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "Adversary determines the nature of state management employed by the target. This includes determining the location (client-side, server-side or both applications) and possibly the items stored as part..."}, {"step": "2", "phase": "Experiment", "description": "The adversary now tries to modify the user state contents (possibly indiscriminately if the contents are encrypted or otherwise obfuscated) or cause a state transition and observe the effects of this ..."}, {"step": "3", "phase": "Exploit", "description": "Having determined how to manipulate the state, the adversary can perform illegitimate actions."}], "related_cwes": ["CWE-372", "CWE-315", "CWE-353", "CWE-693", "CWE-1245", "CWE-1253", "CWE-1265", "CWE-1271"]}, "75": {"name": "Manipulating Writeable Configuration Files", "abstraction": "Standard", "status": "Draft", "description": "Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.", "likelihood": "High", "severity": "Very High", "prerequisites": ["Configuration files must be modifiable by the attacker"], "related_cwes": ["CWE-349", "CWE-99", "CWE-77", "CWE-346", "CWE-353", "CWE-354"]}, "76": {"name": "Manipulating Web Input to File System Calls", "abstraction": "Detailed", "status": "Draft", "description": "An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.", "likelihood": "High", "severity": "Very High", "prerequisites": ["Program must allow for user controlled variables to be applied directly to the filesystem"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Fingerprinting of the operating system] In order to create a valid file injection, the attacker needs to know what the underlying OS is so that the proper file seperator is used."}, {"step": "2", "phase": "Explore", "description": "[Survey the Application to Identify User-controllable Inputs] The attacker surveys the target application to identify all user-controllable inputs, possibly as a valid and authenticated user"}, {"step": "3", "phase": "Experiment", "description": "[Vary inputs, looking for malicious results] Depending on whether the application being exploited is a remote or local one, the attacker crafts the appropriate malicious input containing the path of t..."}, {"step": "4", "phase": "Exploit", "description": "[Manipulate files accessible by the application] The attacker may steal information or directly manipulate files (delete, copy, flush, etc.)"}], "related_cwes": ["CWE-23", "CWE-22", "CWE-73", "CWE-77", "CWE-346", "CWE-348", "CWE-285", "CWE-272", "CWE-59", "CWE-74", "CWE-15"]}, "77": {"name": "Manipulating User-Controlled Variables", "abstraction": "Standard", "status": "Draft", "description": "This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.", "likelihood": "High", "severity": "Very High", "prerequisites": ["A variable consumed by the application server is exposed to the client.", "A variable consumed by the application server can be overwritten by the user.", "The application server trusts user supplied data to compute business logic.", "The application server does not perform proper input validation."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Probe target application] The adversary first probes the target application to determine important information about the target. This information could include types software used, software versions,..."}, {"step": "2", "phase": "Experiment", "description": "[Find user-controlled variables] Using the information found by probing the application, the adversary attempts to manipulate many user-controlled variables and observes the effects on the application..."}, {"step": "3", "phase": "Exploit", "description": "[Manipulate user-controlled variables] Once the adversary has found a user-controller variable(s) that is important to the application, they will manipulate it to change the normal behavior in a way t..."}], "related_cwes": ["CWE-15", "CWE-94", "CWE-96", "CWE-285", "CWE-302", "CWE-473", "CWE-1321"]}, "78": {"name": "Using Escaped Slashes in Alternate Encoding", "abstraction": "Detailed", "status": "Draft", "description": "This attack targets the use of the backslash in alternate encoding. An adversary can provide a backslash as a leading character and causes a parser to believe that the next character is special. This is called an escape. By using that trick, the adversary tries to exploit alternate ways to encode the same character which leads to filter problems and opens avenues to attack.", "likelihood": "High", "severity": "High", "prerequisites": ["The application accepts the backlash character as escape character.", "The application server does incomplete input data decoding, filtering and validation."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application."}, {"step": "2", "phase": "Experiment", "description": "[Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and attempts to escape multiple different special characters using a..."}, {"step": "3", "phase": "Exploit", "description": "[Manipulate input] Once the adversary determines how to bypass filters that filter out special characters using an escaped slash, they will manipulate the user input in a way that is not intended by t..."}], "related_cwes": ["CWE-180", "CWE-181", "CWE-173", "CWE-172", "CWE-73", "CWE-22", "CWE-74", "CWE-20", "CWE-697", "CWE-707"]}, "79": {"name": "Using Slashes in Alternate Encoding", "abstraction": "Detailed", "status": "Draft", "description": "This attack targets the encoding of the Slash characters. An adversary would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world ty...", "likelihood": "High", "severity": "High", "prerequisites": ["The application server accepts paths to locate resources.", "The application server does insufficient input data validation on the resource path requested by the user.", "The access right to resources are not set properly."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application."}, {"step": "2", "phase": "Experiment", "description": "[Probe entry points to locate vulnerabilities] The adversary uses the entry points gathered in the \"Explore\" phase as a target list and looks for areas where user input is used to access resources on ..."}, {"step": "3", "phase": "Exploit", "description": "[Traverse application directories] Once the adversary determines how to bypass filters that filter out slash characters, they will manipulate the user input to include slashes in order to traverse dir..."}], "related_cwes": ["CWE-173", "CWE-180", "CWE-181", "CWE-20", "CWE-74", "CWE-73", "CWE-22", "CWE-185", "CWE-200", "CWE-697", "CWE-707"]}, "8": {"name": "Buffer Overflow in an API Call", "abstraction": "Detailed", "status": "Draft", "description": "This attack targets libraries or shared code modules which are vulnerable to buffer overflow attacks. An adversary who has knowledge of known vulnerable libraries or shared code can easily target software that makes use of these libraries. All clients that make use of the code library thus become vulnerable by association. This has a very broad effect on security across a system, usually affecting more than one software process.", "likelihood": "High", "severity": "High", "prerequisites": ["The target host exposes an API to the user.", "One or more API functions exposed by the target host has a buffer overflow vulnerability."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target application] The adversary, with knowledge of vulnerable libraries or shared code modules, identifies a target application or program that makes use of these."}, {"step": "2", "phase": "Experiment", "description": "[Find injection vector] The adversary attempts to use the API, and if they can they send a large amount of data to see if the buffer overflow attack really does work."}, {"step": "3", "phase": "Experiment", "description": "[Craft overflow content] The adversary crafts the content to be injected based on their knowledge of the vulnerability and their desired outcome. If the intent is to simply cause the software to crash..."}, {"step": "4", "phase": "Exploit", "description": "[Overflow the buffer] Using the API as the injection vector, the adversary injects the crafted overflow content into the buffer."}], "related_cwes": ["CWE-120", "CWE-119", "CWE-118", "CWE-74", "CWE-20", "CWE-680", "CWE-733", "CWE-697"]}, "80": {"name": "Using UTF-8 Encoding to Bypass Validation Logic", "abstraction": "Detailed", "status": "Draft", "description": "This attack is a specific variation on leveraging alternate encodings to bypass validation logic. This attack leverages the possibility to encode potentially harmful input in UTF-8 and submit it to applications not expecting or effective at validating this encoding standard making input filtering difficult. UTF-8 (8-bit UCS/Unicode Transformation Format) is a variable-length character encoding for Unicode. Legal UTF-8 characters are one to four bytes long. However, early version of the UTF-8 spe...", "likelihood": "High", "severity": "High", "prerequisites": ["The application's UTF-8 decoder accepts and interprets illegal UTF-8 characters or non-shortest format of UTF-8 encoding.", "Input filtering and validating is not done properly leaving the door open to harmful characters for the target host."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser or an automated tool, an attacker follows all public links and actions on a web site. They record all the links, the forms, the re..."}, {"step": "2", "phase": "Experiment", "description": "[Probe entry points to locate vulnerabilities] The attacker uses the entry points gathered in the \"Explore\" phase as a target list and injects various UTF-8 encoded payloads to determine if an entry p..."}], "related_cwes": ["CWE-173", "CWE-172", "CWE-180", "CWE-181", "CWE-73", "CWE-74", "CWE-20", "CWE-697", "CWE-692"]}, "81": {"name": "Web Server Logs Tampering", "abstraction": "Detailed", "status": "Draft", "description": "Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to \"Log Injection-Tampering-Forging\" except that in this case, the attack is targeting the logs of the web server and not t...", "likelihood": "Medium", "severity": "High", "prerequisites": ["Target server software must be a HTTP server that performs web logging."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine Application Web Server Log File Format] The attacker observes the system and looks for indicators of which logging utility is being used by the web server."}, {"step": "2", "phase": "Experiment", "description": "[Determine Injectable Content] The attacker launches various logged actions with malicious data to determine what sort of log injection is possible."}, {"step": "3", "phase": "Exploit", "description": "[Manipulate Log Files] The attacker alters the log contents either directly through manipulation or forging or indirectly through injection of specially crafted request that the web server will receiv..."}], "examples": ["Most web servers have a public interface, even if the majority of the site is password protected, there is usually at least a login site and brochureware that is publicly available. HTTP requests to the site are also generally logged to a Web log. From an attacker point of view, standard HTTP reques..."], "related_cwes": ["CWE-117", "CWE-93", "CWE-75", "CWE-221", "CWE-96", "CWE-20", "CWE-150", "CWE-276", "CWE-279", "CWE-116"]}, "82": {"name": "DEPRECATED: Violating Implicit Assumptions Regarding XML Content (aka XML Denial of Service (XDoS))", "abstraction": "Standard", "status": "Deprecated", "description": "This attack pattern has been deprecated as it a generalization of CAPEC-230: XML Nested Payloads, CAPEC-231: XML Oversized Payloads, and CAPEC-147: XML Ping of Death. Please refer to these CAPECs going forward."}, "83": {"name": "XPath Injection", "abstraction": "Detailed", "status": "Draft", "description": "An attacker can craft special user-controllable input consisting of XPath expressions to inject the XML database and bypass authentication or glean information that they normally would not be able to. XPath Injection enables an attacker to talk directly to the XML database, thus bypassing the application completely. XPath Injection results from the failure of an application to properly sanitize input used as part of dynamic XPath expressions used to query an XML database.", "likelihood": "High", "severity": "High", "prerequisites": ["XPath queries used to retrieve information stored in XML documents", "User-controllable input not properly sanitized before being used as part of XPath queries"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the target] Using a browser or an automated tool, an adversary records all instances of user-controllable input used to contruct XPath queries."}, {"step": "2", "phase": "Explore", "description": "[Determine the tructure of queries] Using manual or automated means, test inputs found for XPath weaknesses."}, {"step": "3", "phase": "Exploit", "description": "[Inject content into XPath query] Craft malicious content containing XPath expressions that is not validated by the application and is executed as part of the XPath queries."}], "examples": ["Consider an application that uses an XML database to authenticate its users. The application retrieves the user name and password from a request and forms an XPath expression to query the database. An attacker can successfully bypass authentication and login without valid credentials through XPath I..."], "related_cwes": ["CWE-91", "CWE-74", "CWE-20", "CWE-707"]}, "84": {"name": "XQuery Injection", "abstraction": "Detailed", "status": "Draft", "description": "This attack utilizes XQuery to probe and attack server systems; in a similar manner that SQL Injection allows an attacker to exploit SQL calls to RDBMS, XQuery Injection uses improperly validated data that is passed to XQuery commands to traverse and execute commands that the XQuery routines have access to. XQuery injection can be used to enumerate elements on the victim's environment, inject commands to the local host, or execute queries to remote files and data sources.", "likelihood": "High", "severity": "Very High", "prerequisites": ["The XQL must execute unvalidated data"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for user-controllable inputs] Using a browser or an automated tool, an attacker follows all public links and actions on a web site. They record all the links, the forms, the re..."}, {"step": "2", "phase": "Experiment", "description": "[Determine user-controllable input susceptible to injection] Determine the user-controllable input susceptible to injection. For each user-controllable input that the attacker suspects is vulnerable t..."}, {"step": "3", "phase": "Exploit", "description": "[Information Disclosure] The attacker crafts and injects an XQuery payload which is acted on by an XQL query leading to inappropriate disclosure of information."}, {"step": "4", "phase": "Exploit", "description": "[Manipulate the data in the XML database] The attacker crafts and injects an XQuery payload which is acted on by an XQL query leading to modification of application data."}], "related_cwes": ["CWE-74", "CWE-707"]}, "85": {"name": "AJAX Footprinting", "abstraction": "Detailed", "status": "Draft", "description": "This attack utilizes the frequent client-server roundtrips in Ajax conversation to scan a system. While Ajax does not open up new vulnerabilities per se, it does optimize them from an attacker point of view. A common first step for an attacker is to footprint the target environment to understand what attacks will work. Since footprinting relies on enumeration, the conversational pattern of rapid, multiple requests and responses that are typical in Ajax applications enable an attacker to look for...", "likelihood": "High", "severity": "Low", "prerequisites": ["The user must allow JavaScript to execute in their browser"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Send request to target webpage and analyze HTML] Using a browser or an automated tool, an adversary sends requests to a webpage and records the received HTML response. Adversaries then analyze the HT..."}], "examples": ["Footprinting can be executed over almost any protocol including HTTP, TCP, UDP, and ICMP, with the general goal of gaining further information about a host environment to launch further attacks. The attacker can probe the system for banners, vulnerabilities, filenames, available services, and in sho..."], "related_cwes": ["CWE-79", "CWE-113", "CWE-348", "CWE-96", "CWE-20", "CWE-116", "CWE-184", "CWE-86", "CWE-692"]}, "86": {"name": "XSS Through HTTP Headers", "abstraction": "Detailed", "status": "Draft", "description": "An adversary exploits web applications that generate web content, such as links in a HTML page, based on unvalidated or improperly validated data submitted by other actors. XSS in HTTP Headers attacks target the HTTP headers which are hidden from most users and may not be validated by web applications.", "likelihood": "High", "severity": "Very High", "prerequisites": ["Target software must be a client that allows scripting communication from remote hosts."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Survey the application for public links] Using a browser or an automated tool, an adversary follows all public links on a web site. They record all the entry points (input) that becomes part of gener..."}, {"step": "2", "phase": "Experiment", "description": "[Probe identified potential entry points for XSS vulnerability]"}, {"step": "3", "phase": "Experiment", "description": "[Craft malicious XSS URL] Once the adversary has determined which parameters are vulnerable to XSS, they will craft a malicious URL containing the XSS exploit. The adversary can have many goals, from ..."}, {"step": "4", "phase": "Exploit", "description": "[Get victim to click URL] In order for the attack to be successful, the victim needs to access the malicious URL."}], "examples": ["XSS can be used in variety of ways, because it is scripted and executes in a distributed, asynchronous fashion it can create its own vector and openings. For example, the adversary can use XSS to mount a DDoS attack by having series of different computers unknowingly executing requests against a sin..."], "related_cwes": ["CWE-80"]}, "87": {"name": "Forceful Browsing", "abstraction": "Standard", "status": "Draft", "description": "An attacker employs forceful browsing (direct URL entry) to access portions of a website that are otherwise unreachable. Usually, a front controller or similar design pattern is employed to protect access to portions of a web application. Forceful browsing enables an attacker to access information, perform privileged operations and otherwise reach sections of the web application that have been improperly protected.", "likelihood": "High", "severity": "High", "prerequisites": ["The forcibly browseable pages or accessible resources must be discoverable and improperly protected."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Spider] Using an automated tool, an attacker follows all public links on a web site. They record all the links they find."}, {"step": "2", "phase": "Experiment", "description": "[Attempt well-known or guessable resource locations] Using an automated tool, an attacker requests a variety of well-known URLs that correspond to administrative, debugging, or other useful internal a..."}, {"step": "3", "phase": "Exploit", "description": "[Use unauthorized resources] By visiting the unprotected resource, the attacker makes use of unauthorized functionality."}, {"step": "4", "phase": "Exploit", "description": "[View unauthorized data] The attacker discovers and views unprotected sensitive data."}], "related_cwes": ["CWE-425", "CWE-285", "CWE-693"]}, "88": {"name": "OS Command Injection", "abstraction": "Standard", "status": "Draft", "description": "In this type of an attack, an adversary injects operating system commands into existing application functions. An application that uses untrusted input to build command strings is vulnerable. An adversary can leverage OS command injection in an application to elevate privileges, execute arbitrary commands and compromise the underlying operating system.", "likelihood": "High", "severity": "High", "prerequisites": ["User controllable input used as part of commands to the underlying operating system."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify inputs for OS commands] The attacker determines user controllable input that gets passed as part of a command to the underlying operating system."}, {"step": "2", "phase": "Explore", "description": "[Survey the Application] The attacker surveys the target application, possibly as a valid and authenticated user"}, {"step": "3", "phase": "Experiment", "description": "[Vary inputs, looking for malicious results.] Depending on whether the application being exploited is a remote or local one the attacker crafts the appropriate malicious input, containing OS commands,..."}, {"step": "4", "phase": "Exploit", "description": "[Execute malicious commands] The attacker may steal information, install a back door access mechanism, elevate privileges or compromise the system in some other way."}], "related_cwes": ["CWE-78", "CWE-88", "CWE-20", "CWE-697"]}, "89": {"name": "Pharming", "abstraction": "Standard", "status": "Draft", "description": "A pharming attack occurs when the victim is fooled into entering sensitive data into supposedly trusted locations, such as an online bank site or a trading platform. An attacker can impersonate these supposedly trusted sites and have the victim be directed to their site rather than the originally intended one. Pharming does not require script injection or clicking on malicious links for the attack to succeed.", "likelihood": "High", "severity": "Very High", "prerequisites": ["Vulnerable DNS software or improperly protected hosts file or router that can be poisoned", "A website that handles sensitive information but does not use a secure connection and a certificate that is valid is also prone to pharming"], "execution_flow": [{"step": "1", "phase": "Exploit", "description": "Attacker sets up a system mocking the one trusted by the users. This is usually a website that requires or handles sensitive information."}, {"step": "2", "phase": "Exploit", "description": "The attacker then poisons the resolver for the targeted site. This is achieved by poisoning the DNS server, or the local hosts file, that directs the user to the original website"}, {"step": "3", "phase": "Exploit", "description": "When the victim requests the URL for the site, the poisoned records direct the victim to the attackers' system rather than the original one."}, {"step": "4", "phase": "Exploit", "description": "Because of the identical nature of the original site and the attacker controlled one, and the fact that the URL is still the original one, the victim trusts the website reached and the attacker can no..."}], "related_cwes": ["CWE-346", "CWE-350"]}, "9": {"name": "Buffer Overflow in Local Command-Line Utilities", "abstraction": "Detailed", "status": "Draft", "description": "This attack targets command-line utilities available in a number of shells. An adversary can leverage a vulnerability found in a command-line utility to escalate privilege to root.", "likelihood": "High", "severity": "High", "prerequisites": ["The target host exposes a command-line utility to the user.", "The command-line utility exposed by the target host has a buffer overflow vulnerability that can be exploited."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify target system] The adversary first finds a target system that they want to gain elevated priveleges on. This could be a system they already have some level of access to or a system that they..."}, {"step": "2", "phase": "Explore", "description": "[Find injection vector] The adversary identifies command line utilities exposed by the target host that contain buffer overflow vulnerabilites. The adversary likely knows which utilities have these vu..."}, {"step": "3", "phase": "Experiment", "description": "[Craft overflow command] Once the adversary has found a vulnerable utility, they will use their knownledge of the vulnerabilty to create the command that will exploit the buffer overflow."}, {"step": "4", "phase": "Exploit", "description": "[Overflow the buffer] Using the injection vector, the adversary executes the crafted command, gaining elevated priveleges on the machine."}], "related_cwes": ["CWE-120", "CWE-118", "CWE-119", "CWE-74", "CWE-20", "CWE-680", "CWE-733", "CWE-697"]}, "90": {"name": "Reflection Attack in Authentication Protocol", "abstraction": "Standard", "status": "Draft", "description": "An adversary can abuse an authentication protocol susceptible to reflection attack in order to defeat it. Doing so allows the adversary illegitimate access to the target system, without possessing the requisite credentials. Reflection attacks are of great concern to authentication protocols that rely on a challenge-handshake or similar mechanism. An adversary can impersonate a legitimate user and can gain illegitimate access to the system by successfully mounting a reflection attack during authe...", "likelihood": "High", "severity": "High", "prerequisites": ["The attacker must have direct access to the target server in order to successfully mount a reflection attack. An intermediate entity, such as a router or proxy, that handles these exchanges on behalf ..."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Identify service with vulnerable handshake authentication] The adversary must first identify a vulnerable authentication protocol. The most common indication of an authentication protocol vulnerable ..."}, {"step": "2", "phase": "Experiment", "description": "[Send challenge to target server] The adversary opens a connection to the target server and sends it a challenge. This challenge is arbitrary and is simply used as a placeholder for the protocol in or..."}, {"step": "3", "phase": "Experiment", "description": "[Receive server challenge] The server responds by returning the challenge sent encrypted with the server's pre-shared key, as well as its own challenge to the attacker sent in plaintext. We will call ..."}, {"step": "4", "phase": "Experiment", "description": "[Initiate second handshake] Since the adversary does not possess the pre-shared key, they cannot encrypt C from the previous step in order for the server to authenticate them. To get around this, the ..."}, {"step": "5", "phase": "Experiment", "description": "[Receive encrypted challenge] The server treats the intial client challenge in connection two as an arbitrary client challenge and responds by encrypting C with the pre-shared key. The server also sen..."}, {"step": "6", "phase": "Exploit", "description": "The adversary now posseses the encrypted version of C that is obtained through connection two. The adversary continues the handshake in connection one by responding to the server with the encrypted ve..."}], "related_cwes": ["CWE-301", "CWE-303"]}, "91": {"name": "DEPRECATED: XSS in IMG Tags", "abstraction": "Detailed", "status": "Deprecated", "description": "This attack pattern has been deprecated as it is contained in the existing attack pattern \"CAPEC-18 : XSS Targeting Non-Script Elements\". Please refer to this other CAPEC going forward."}, "92": {"name": "Forced Integer Overflow", "abstraction": "Detailed", "status": "Draft", "description": "This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can ...", "likelihood": "High", "severity": "High", "prerequisites": ["The attacker can manipulate the value of an integer variable utilized by the target host.", "The target host does not do proper range checking on the variable before utilizing it.", "When the integer variable is incremented or decremented to an out of range value, it gets a very different value (e.g. very small or negative number)"], "execution_flow": [{"step": "1", "phase": "Explore", "description": "The first step is exploratory meaning the attacker looks for an integer variable that they can control."}, {"step": "2", "phase": "Experiment", "description": "The attacker finds an integer variable that they can write into or manipulate and try to get the value of the integer out of the possible range."}, {"step": "3", "phase": "Exploit", "description": "The integer variable is forced to have a value out of range which set its final value to an unexpected value."}, {"step": "4", "phase": "Exploit", "description": "The target host acts on the data and unexpected behavior may happen."}], "examples": ["Integer overflow in the ProcAuWriteElement function in server/dia/audispatch.c in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large max_samples value. See also: CVE-2007-1544"], "related_cwes": ["CWE-190", "CWE-128", "CWE-120", "CWE-122", "CWE-196", "CWE-680", "CWE-697"]}, "93": {"name": "Log Injection-Tampering-Forging", "abstraction": "Detailed", "status": "Draft", "description": "This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing them to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.", "likelihood": "High", "severity": "High", "prerequisites": ["The target host is logging the action and data of the user.", "The target host insufficiently protects access to the logs or logging mechanisms."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine Application's Log File Format] The first step is exploratory meaning the attacker observes the system. The attacker looks for action and data that are likely to be logged. The attacker may ..."}, {"step": "2", "phase": "Exploit", "description": "[Manipulate Log Files] The attacker alters the log contents either directly through manipulation or forging or indirectly through injection of specially crafted input that the target software will wri..."}], "examples": ["Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50, and possibly earlier versions, allows remote attackers to enter false payment entries into the log file via HTTP POST requests to ipn_success.php. See also: CVE-2006-0201"], "related_cwes": ["CWE-117", "CWE-75", "CWE-150"]}, "94": {"name": "Adversary in the Middle (AiTM)", "abstraction": "Meta", "status": "Stable", "likelihood": "High", "severity": "Very High", "prerequisites": ["There are two components communicating with each other.", "An attacker is able to identify the nature and mechanism of communication between the two target components.", "An attacker can eavesdrop on the communication between the target components.", "Strong mutual authentication is not used between the two target components yielding opportunity for attacker interposition.", "The communication occurs in clear (not encrypted) or with insufficient and spoofable encryption."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Determine Communication Mechanism] The adversary determines the nature and mechanism of communication between two components, looking for opportunities to exploit."}, {"step": "2", "phase": "Experiment", "description": "[Position In Between Targets] The adversary inserts themself into the communication channel initially acting as a routing proxy between the two targeted components."}, {"step": "3", "phase": "Exploit", "description": "[Use Intercepted Data Maliciously] The adversary observes, filters, or alters passed data of its choosing to gain access to sensitive information or to manipulate the actions of the two target compone..."}], "related_cwes": ["CWE-300", "CWE-290", "CWE-593", "CWE-287", "CWE-294"]}, "95": {"name": "WSDL Scanning", "abstraction": "Detailed", "status": "Draft", "description": "This attack targets the WSDL interface made available by a web service. The attacker may scan the WSDL interface to reveal sensitive information about invocation patterns, underlying technology implementations and associated vulnerabilities. This type of probing is carried out to perform more serious attacks (e.g. parameter tampering, malicious content injection, command injection, etc.). WSDL files provide detailed information about the services ports and bindings available to consumers. For in...", "likelihood": "High", "severity": "High", "prerequisites": ["A client program connecting to a web service can read the WSDL to determine what functions are available on the server.", "The target host exposes vulnerable functions within its WSDL interface."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Scan for WSDL Documents] The adversary scans for WSDL documents. The WDSL document written in XML is like a handbook on how to communicate with the web services provided by the target host. It provid..."}, {"step": "2", "phase": "Experiment", "description": "[Analyze WSDL files] An adversary will analyze the WSDL files and try to find potential weaknesses by sending messages matching the pattern described in the WSDL file. The adversary could run through ..."}, {"step": "3", "phase": "Exploit", "description": "[Craft malicious content] Once an adversary finds a potential weakness, they can craft malicious content to be sent to the system. For instance the adversary may try to submit special characters and o..."}], "examples": ["A WSDL interface may expose a function vulnerable to SQL Injection."], "related_cwes": ["CWE-538"]}, "96": {"name": "Block Access to Libraries", "abstraction": "Detailed", "status": "Draft", "description": "An application typically makes calls to functions that are a part of libraries external to the application. These libraries may be part of the operating system or they may be third party libraries. It is possible that the application does not handle situations properly where access to these libraries has been blocked. Depending on the error handling within the application, blocked access to libraries may leave the system in an insecure state that could be leveraged by an attacker.", "likelihood": "Medium", "severity": "Medium", "prerequisites": ["An application requires access to external libraries.", "An attacker has the privileges to block application access to external libraries."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "Determine what external libraries the application accesses."}, {"step": "2", "phase": "Experiment", "description": "Block access to the external libraries accessed by the application."}, {"step": "3", "phase": "Experiment", "description": "Monitor the behavior of the system to see if it goes into an insecure/inconsistent state."}, {"step": "4", "phase": "Experiment", "description": "If the system does go into an insecure/inconsistent state, leverage that to obtain information about the system functionality or data, elevate access control, etc. The rest of this attack will depend ..."}], "examples": ["A web-based system uses a third party cryptographic random number generation library that derives entropy from machine's hardware. This library is used in generation of user session ids used by the application. If the library is inaccessible, the application instead uses a software based weak pseudo..."], "related_cwes": ["CWE-589"]}, "97": {"name": "Cryptanalysis", "abstraction": "Standard", "status": "Draft", "description": "Cryptanalysis is a process of finding weaknesses in cryptographic algorithms and using these weaknesses to decipher the ciphertext without knowing the secret key (instance deduction). Sometimes the weakness is not in the cryptographic algorithm itself, but rather in how it is applied that makes cryptanalysis successful. An attacker may have other goals as well, such as: Total Break (finding the secret key), Global Deduction (finding a functionally equivalent algorithm for encryption and decrypti...", "likelihood": "Low", "severity": "Very High", "prerequisites": ["The target software utilizes some sort of cryptographic algorithm.", "An underlying weaknesses exists either in the cryptographic algorithm used or in the way that it was applied to a particular chunk of plaintext.", "The encryption algorithm is known to the attacker.", "An attacker has access to the ciphertext."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "An attacker discovers a weakness in the cryptographic algorithm or a weakness in how it was applied to a particular chunk of plaintext."}, {"step": "2", "phase": "Exploit", "description": "An attacker leverages the discovered weakness to decrypt, partially decrypt or infer some information about the contents of the encrypted message. All of that is done without knowing the secret key."}], "examples": ["A very easy to understand example is a cryptanalysis technique called frequency analysis that can be successfully applied to the very basic classic encryption algorithms that performed mono-alphabetic substitution replacing each letter in the plaintext with its predetermined mapping letter from the ..."], "related_cwes": ["CWE-327", "CWE-1204", "CWE-1240", "CWE-1241", "CWE-1279"]}, "98": {"name": "Phishing", "abstraction": "Standard", "status": "Draft", "description": "Phishing is a social engineering technique where an attacker masquerades as a legitimate entity with which the victim might do business in order to prompt the user to reveal some confidential information (very frequently authentication credentials) that can later be used by an attacker. Phishing is essentially a form of information gathering or \"fishing\" for information.", "likelihood": "High", "severity": "Very High", "prerequisites": ["An attacker needs to have a way to initiate contact with the victim. Typically that will happen through e-mail.", "An attacker needs to correctly guess the entity with which the victim does business and impersonate it. Most of the time phishers just use the most popular banks/services and send out their \"hooks\" to...", "An attacker needs to have a sufficiently compelling call to action to prompt the user to take action.", "The replicated website needs to look extremely similar to the original website and the URL used to get to that website needs to look like the real URL of the said business entity."], "execution_flow": [{"step": "1", "phase": "Explore", "description": "[Obtain domain name and certificate to spoof legitimate site] This optional step can be used to help the attacker impersonate the legitimate site more convincingly. The attacker can use homograph atta..."}, {"step": "2", "phase": "Explore", "description": "[Explore legitimate website and create duplicate] An attacker creates a website (optionally at a URL that looks similar to the original URL) that closely resembles the website that they are trying to ..."}, {"step": "3", "phase": "Exploit", "description": "[Convince user to enter sensitive information on attacker's site.] An attacker sends an e-mail to the victim that has some sort of a call to action to get the user to click on the link included in the..."}, {"step": "4", "phase": "Exploit", "description": "[Use stolen credentials to log into legitimate site] Once the attacker captures some sensitive information through phishing (login credentials, credit card information, etc.) the attacker can leverage..."}], "examples": ["The target gets an official looking e-mail from their bank stating that their account has been temporarily locked due to suspected unauthorized activity and that they need to click on the link included in the e-mail to log in to their bank account in order to unlock it. The link in the e-mail looks ...", "An adversary may use BlueJacking, or Bluetooth Phishing to send unsolicited contact cards, messages, or pictures to nearby devices that are listening via Bluetooth. These messages may contain phishing content."], "related_cwes": ["CWE-451"]}, "99": {"name": "DEPRECATED: XML Parser Attack", "abstraction": "Standard", "status": "Deprecated", "description": "This attack pattern has been deprecated as it a generalization of CAPEC-230: XML Nested Payloads and CAPEC-231: XML Oversized Payloads. Please refer to these CAPECs going forward."}}