Attack patterns (CAPEC)

558 pages, showing 101–200, ordered by identifier.

CAPEC-196 — Session Credential Falsification through Forging An attacker creates a false but functional session credential in order to gain or usurp access to a service. Session...
CAPEC-197 — Exponential Data Expansion An adversary submits data to a target application which contains nested exponential data expansion to produce...
CAPEC-198 — XSS Targeting Error Pages An adversary distributes a link (or possibly some other query structure) with a request to a third party web server...
CAPEC-199 — XSS Using Alternate Syntax An adversary uses alternate forms of keywords or commands that result in the same action as the primary form but...
CAPEC-2 — Inducing Account Lockout An attacker leverages the security functionality of the system aimed at thwarting potential attacks to launch a...
CAPEC-20 — Encryption Brute Forcing An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force)...
CAPEC-200 — Removal of filters: Input filters, output filters, data masking An attacker removes or disables filtering mechanisms on the target application. Input filters prevent invalid data...
CAPEC-201 — Serialized Data External Linking An adversary creates a serialized data file (e.g. XML, YAML, etc...) that contains an external data reference....
CAPEC-202 — Create Malicious Client An adversary creates a client application to interface with a target service where the client violates assumptions...
CAPEC-203 — Manipulate Registry Information An adversary exploits a weakness in authorization in order to modify content within a registry (e.g., Windows...
CAPEC-204 — Lifting Sensitive Data Embedded in Cache An adversary examines a target application's cache, or a browser cache, for sensitive information. Many applications...
CAPEC-206 — Signing Malicious Code The adversary extracts credentials used for code signing from a production environment and then uses these...
CAPEC-207 — Removing Important Client Functionality An adversary removes or disables functionality on the client that the server assumes to be present and trustworthy.
CAPEC-208 — Removing/short-circuiting 'Purse' logic: removing/mutating 'cash' decrements An attacker removes or modifies the logic on a client associated with monetary calculations resulting in incorrect...
CAPEC-209 — XSS Using MIME Type Mismatch An adversary creates a file with scripting content but where the specified MIME type of the file is such that...
CAPEC-21 — Exploitation of Trusted Identifiers An adversary guesses, obtains, or 'rides' a trusted identifier (e.g. session ID, resource ID, cookie, etc.) to...
CAPEC-212 — Functionality Misuse An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical...
CAPEC-215 — Fuzzing for application mapping An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the...
CAPEC-216 — Communication Channel Manipulation An adversary manipulates a setting or parameter on communications channel in order to compromise its security. This...
CAPEC-217 — Exploiting Incorrectly Configured SSL/TLS An adversary takes advantage of incorrectly configured SSL/TLS communications that enables access to data intended...
CAPEC-218 — Spoofing of UDDI/ebXML Messages An attacker spoofs a UDDI, ebXML, or similar message in order to impersonate a service provider in an e-business...
CAPEC-219 — XML Routing Detour Attacks An attacker subverts an intermediate system used to process XML content and forces the intermediate to modify and/or...
CAPEC-22 — Exploiting Trust in Client An attack of this type exploits vulnerabilities in client/server communication channel authentication and data...
CAPEC-220 — Client-Server Protocol Manipulation An adversary takes advantage of weaknesses in the protocol by which a client and server are communicating to perform...
CAPEC-221 — Data Serialization External Entities Blowup This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML,...
CAPEC-222 — iFrame Overlay In an iFrame overlay attack the victim is tricked into unknowingly initiating some action in one system while...
CAPEC-224 — Fingerprinting An adversary compares output from a target system to known indicators that uniquely identify specific details about...
CAPEC-226 — Session Credential Falsification through Manipulation An attacker manipulates an existing credential in order to gain access to a target application. Session credentials...
CAPEC-227 — Sustained Client Engagement An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in...
CAPEC-228 — DTD Injection An attacker injects malicious content into an application's DTD in an attempt to produce a negative technical...
CAPEC-229 — Serialized Data Parameter Blowup This attack exploits certain serialized data parsers (e.g., XML, YAML, etc.) which manage data in an inefficient...
CAPEC-23 — File Content Injection An adversary poisons files with a malicious payload (targeting the file systems accessible by the target software),...
CAPEC-230 — Serialized Data with Nested Payloads Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may...
CAPEC-231 — Oversized Serialized Data Payloads An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse...
CAPEC-233 — Privilege Escalation An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not...
CAPEC-234 — Hijacking a privileged process An adversary gains control of a process that is assigned elevated privileges in order to execute arbitrary code with...
CAPEC-237 — Escaping a Sandbox by Calling Code in Another Language The attacker may submit malicious code of another language to obtain access to privileges that were not...
CAPEC-24 — Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may...
CAPEC-240 — Resource Injection An adversary exploits weaknesses in input validation by manipulating resource identifiers enabling the unintended...
CAPEC-242 — Code Injection An adversary exploits a weakness in input validation on the target to inject new code into that which is currently...
CAPEC-243 — XSS Targeting HTML Attributes An adversary inserts commands to perform cross-site scripting (XSS) actions in HTML attributes. Many filters do not...
CAPEC-244 — XSS Targeting URI Placeholders An attack of this type exploits the ability of most browsers to interpret 'data', 'javascript' or other URI schemes...
CAPEC-245 — XSS Using Doubled Characters The adversary bypasses input validation by using doubled characters in order to perform a cross-site scripting...
CAPEC-247 — XSS Using Invalid Characters An adversary inserts invalid characters in identifiers to bypass application filtering of input. Filters may not...
CAPEC-248 — Command Injection An adversary looking to execute a command of their choosing, injects new items into an existing command thus...
CAPEC-25 — Forced Deadlock The adversary triggers and exploits a deadlock condition in the target software to cause a denial of service. A...
CAPEC-250 — XML Injection An attacker utilizes crafted XML user-controllable input to probe, attack, and inject data into the XML database,...
CAPEC-251 — Local Code Inclusion The attacker forces an application to load arbitrary code files from the local machine. The attacker could use this...
CAPEC-252 — PHP Local File Inclusion The attacker loads and executes an arbitrary local PHP file on a target machine. The attacker could use this to try...
CAPEC-253 — Remote Code Inclusion The attacker forces an application to load arbitrary code files from a remote location. The attacker could use this...
CAPEC-256 — SOAP Array Overflow An attacker sends a SOAP request with an array whose actual length exceeds the length indicated in the request. If...
CAPEC-26 — Leveraging Race Conditions The adversary targets a race condition occurring when multiple processes access and manipulate the same resource...
CAPEC-261 — Fuzzing for garnering other adjacent user/sensitive data An adversary who is authorized to send queries to a target sends variants of expected queries in the hope that these...
CAPEC-263 — Force Use of Corrupted Files This describes an attack where an application is forced to use a file that an attacker has corrupted. The result is...
CAPEC-267 — Leverage Alternate Encoding An adversary leverages the possibility to encode potentially harmful input or content used by applications such that...
CAPEC-268 — Audit Log Manipulation The attacker injects, manipulates, deletes, or forges malicious log entries into the log file, in an attempt to...
CAPEC-27 — Leveraging Race Conditions via Symbolic Links This attack leverages the use of symbolic links (Symlinks) in order to write to sensitive files. An attacker can...
CAPEC-270 — Modification of Registry Run Keys An adversary adds a new entry to the 'run keys' in the Windows registry so that an application of their choosing is...
CAPEC-271 — Schema Poisoning An adversary corrupts or modifies the content of a schema for the purpose of undermining the security of the target....
CAPEC-272 — Protocol Manipulation An adversary subverts a communications protocol to perform an attack. This type of attack can allow an adversary to...
CAPEC-273 — HTTP Response Smuggling An adversary manipulates and injects malicious content in the form of secret unauthorized HTTP responses, into a...
CAPEC-274 — HTTP Verb Tampering An attacker modifies the HTTP Verb (e.g. GET, PUT, TRACE, etc.) in order to bypass access restrictions. Some web...
CAPEC-275 — DNS Rebinding An adversary serves content whose IP address is resolved by a DNS server that the adversary controls. After initial...
CAPEC-276 — Inter-component Protocol Manipulation Inter-component protocols are used to communicate between different software and hardware modules within a single...
CAPEC-277 — Data Interchange Protocol Manipulation Data Interchange Protocols are used to transmit structured data between entities. These protocols are often specific...
CAPEC-278 — Web Services Protocol Manipulation An adversary manipulates a web service related protocol to cause a web application or service to react differently...
CAPEC-279 — SOAP Manipulation Simple Object Access Protocol (SOAP) is used as a communication protocol between a client and server to invoke web...
CAPEC-28 — Fuzzing In this attack pattern, the adversary leverages fuzzing to try to identify weaknesses in the system. Fuzzing is a...
CAPEC-285 — ICMP Echo Request Ping An adversary sends out an ICMP Type 8 Echo Request, commonly known as a 'Ping', in order to determine if a target...
CAPEC-287 — TCP SYN Scan An adversary uses a SYN scan to determine the status of ports on the remote target. SYN scanning is the most common...
CAPEC-29 — Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions This attack targets a race condition occurring between the time of check (state) for a resource and the time of use...
CAPEC-290 — Enumerate Mail Exchange (MX) Records An adversary enumerates the MX records for a given via a DNS query. This type of information gathering returns the...
CAPEC-291 — DNS Zone Transfers An attacker exploits a DNS misconfiguration that permits a ZONE transfer. Some external DNS servers will return a...
CAPEC-292 — Host Discovery An adversary sends a probe to an IP address to determine if the host is alive. Host discovery is one of the earliest...
CAPEC-293 — Traceroute Route Enumeration An adversary uses a traceroute utility to map out the route which data flows through the network in route to a...
CAPEC-294 — ICMP Address Mask Request An adversary sends an ICMP Type 17 Address Mask Request to gather information about a target's networking...
CAPEC-295 — Timestamp Request This pattern of attack leverages standard requests to learn the exact time associated with a target system. An...
CAPEC-296 — ICMP Information Request An adversary sends an ICMP Information Request to a host to determine if it will respond to this deprecated...
CAPEC-297 — TCP ACK Ping An adversary sends a TCP segment with the ACK flag set to a remote host for the purpose of determining if the host...
CAPEC-298 — UDP Ping An adversary sends a UDP datagram to the remote host to determine if the host is alive. If a UDP datagram is sent to...
CAPEC-299 — TCP SYN Ping An adversary uses TCP SYN packets as a means towards host discovery. Typical RFC 793 behavior specifies that when a...
CAPEC-3 — Using Leading 'Ghost' Character Sequences to Bypass Input Filters Some APIs will strip certain leading characters from a string of parameters. An adversary can intentionally...
CAPEC-30 — Hijacking a Privileged Thread of Execution An adversary hijacks a privileged thread of execution by injecting malicious code into a running process. By using a...
CAPEC-300 — Port Scanning An adversary uses a combination of techniques to determine the state of the ports on a remote target. Any service or...
CAPEC-301 — TCP Connect Scan An adversary uses full TCP connection attempts to determine if a port is open on the target system. The scanning...
CAPEC-302 — TCP FIN Scan An adversary uses a TCP FIN scan to determine if ports are closed on the target machine. This scan type is...
CAPEC-303 — TCP Xmas Scan An adversary uses a TCP XMAS scan to determine if ports are closed on the target machine. This scan type is...
CAPEC-304 — TCP Null Scan An adversary uses a TCP NULL scan to determine if ports are closed on the target machine. This scan type is...
CAPEC-305 — TCP ACK Scan An adversary uses TCP ACK segments to gather information about firewall or ACL configuration. The purpose of this...
CAPEC-306 — TCP Window Scan An adversary engages in TCP Window scanning to analyze port status and operating system type. TCP Window scanning...
CAPEC-307 — TCP RPC Scan An adversary scans for RPC services listing on a Unix/Linux host.
CAPEC-308 — UDP Scan An adversary engages in UDP scanning to gather information about UDP port status on the target system. UDP scanning...
CAPEC-309 — Network Topology Mapping An adversary engages in scanning activities to map network nodes, hosts, devices, and routes. Adversaries usually...
CAPEC-31 — Accessing/Intercepting/Modifying HTTP Cookies This attack relies on the use of HTTP Cookies to store credentials, state information and other critical data on...
CAPEC-310 — Scanning for Vulnerable Software An attacker engages in scanning activity to find vulnerable software versions or types, such as operating system...
CAPEC-312 — Active OS Fingerprinting An adversary engages in activity to detect the operating system or firmware version of a remote target by...
CAPEC-313 — Passive OS Fingerprinting An adversary engages in activity to detect the version or type of OS software in a an environment by passively...
CAPEC-317 — IP ID Sequencing Probe This OS fingerprinting probe analyzes the IP 'ID' field sequence number generation algorithm of a remote host....
CAPEC-318 — IP 'ID' Echoed Byte-Order Probe This OS fingerprinting probe tests to determine if the remote host echoes back the IP 'ID' value from the probe...
CAPEC-319 — IP (DF) 'Don't Fragment Bit' Echoing Probe This OS fingerprinting probe tests to determine if the remote host echoes back the IP 'DF' (Don't Fragment) bit in a...

Browse by topic

Every page in the corpus, grouped. Search finds one page; this shows what else is here.