Umbra Wiki attack-pattern attack-pattern/CAPEC-261
Back to wiki

CAPEC-261 — Fuzzing for garnering other adjacent user/sensitive data

provenance: imported · CWE: CWE-20

CAPEC-261: Fuzzing for garnering other adjacent user/sensitive data

MITRE CAPEC attack pattern

Status Draft
Typical severity Medium
Likelihood of attack
Catalogue CAPEC 3.9 (2023-01-24)

Description

An adversary who is authorized to send queries to a target sends variants of expected queries in the hope that these modified queries might return information (directly or indirectly through error logs) beyond what the expected set of queries should provide.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-20

Prerequisites

  • The server must assume that the queries it receives follow specific templates and/or have fields or attributes that follow specific procedures. The server must process queries that it receives without adequately checking or sanitizing queries to ensure they follow these templates.

Source

Related

weakness/CWE-20