Threat intelligence / filtered
platform “capec”
11300 objects matching the active filter. Open an object to inspect its relationships and provenance.
Evidence stream
Filtered — platform “capec”
01DEPRECATED: XML Parser AttackThis attack pattern has been deprecated as it a generalization of CAPEC-230: XML Nested Payloads and CAPEC-231: XML Oversized Payloads. Please refer to these CAPECs going forward.TechniqueCAPEC-9902PhishingPhishing is a social engineering technique where an attacker masquerades as a legitimate entity with which the victim might do business in order to prompt the user to reveal some confidential information (very frequently authentication cred…TechniqueCAPEC-9803CryptanalysisCryptanalysis is a process of finding weaknesses in cryptographic algorithms and using these weaknesses to decipher the ciphertext without knowing the secret key (instance deduction). Sometimes the weakness is not in the cryptographic algor…TechniqueCAPEC-9704Block Access to LibrariesAn application typically makes calls to functions that are a part of libraries external to the application. These libraries may be part of the operating system or they may be third party libraries. It is possible that the application does n…TechniqueCAPEC-9605WSDL ScanningThis attack targets the WSDL interface made available by a web service. The attacker may scan the WSDL interface to reveal sensitive information about invocation patterns, underlying technology implementations and associated vulnerabilities…TechniqueCAPEC-9506Adversary in the Middle (AiTM){"p":"An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channe…TechniqueCAPEC-9407Log Injection-Tampering-ForgingThis attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing them to mislead a log audit, cover traces of attack, or perform other malicious actions. The t…TechniqueCAPEC-9308Forced Integer OverflowThis attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out…TechniqueCAPEC-9209DEPRECATED: XSS in IMG TagsThis attack pattern has been deprecated as it is contained in the existing attack pattern "CAPEC-18 : XSS Targeting Non-Script Elements". Please refer to this other CAPEC going forward.TechniqueCAPEC-9110Reflection Attack in Authentication ProtocolAn adversary can abuse an authentication protocol susceptible to reflection attack in order to defeat it. Doing so allows the adversary illegitimate access to the target system, without possessing the requisite credentials. Reflection attac…TechniqueCAPEC-9011Buffer Overflow in Local Command-Line UtilitiesThis attack targets command-line utilities available in a number of shells. An adversary can leverage a vulnerability found in a command-line utility to escalate privilege to root.TechniqueCAPEC-912PharmingA pharming attack occurs when the victim is fooled into entering sensitive data into supposedly trusted locations, such as an online bank site or a trading platform. An attacker can impersonate these supposedly trusted sites and have the vi…TechniqueCAPEC-8913OS Command InjectionIn this type of an attack, an adversary injects operating system commands into existing application functions. An application that uses untrusted input to build command strings is vulnerable. An adversary can leverage OS command injection i…TechniqueCAPEC-8814Forceful BrowsingAn attacker employs forceful browsing (direct URL entry) to access portions of a website that are otherwise unreachable. Usually, a front controller or similar design pattern is employed to protect access to portions of a web application. F…TechniqueCAPEC-8715XSS Through HTTP HeadersAn adversary exploits web applications that generate web content, such as links in a HTML page, based on unvalidated or improperly validated data submitted by other actors. XSS in HTTP Headers attacks target the HTTP headers which are hidde…TechniqueCAPEC-8616AJAX FootprintingThis attack utilizes the frequent client-server roundtrips in Ajax conversation to scan a system. While Ajax does not open up new vulnerabilities per se, it does optimize them from an attacker point of view. A common first step for an attac…TechniqueCAPEC-8517XQuery InjectionThis attack utilizes XQuery to probe and attack server systems; in a similar manner that SQL Injection allows an attacker to exploit SQL calls to RDBMS, XQuery Injection uses improperly validated data that is passed to XQuery commands to tr…TechniqueCAPEC-8418XPath InjectionAn attacker can craft special user-controllable input consisting of XPath expressions to inject the XML database and bypass authentication or glean information that they normally would not be able to. XPath Injection enables an attacker to …TechniqueCAPEC-8319DEPRECATED: Violating Implicit Assumptions Regarding XML Content (aka XML Denial of Service (XDoS))This attack pattern has been deprecated as it a generalization of CAPEC-230: XML Nested Payloads, CAPEC-231: XML Oversized Payloads, and CAPEC-147: XML Ping of Death. Please refer to these CAPECs going forward.TechniqueCAPEC-8220Web Server Logs TamperingWeb Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may ta…TechniqueCAPEC-8121Using UTF-8 Encoding to Bypass Validation LogicThis attack is a specific variation on leveraging alternate encodings to bypass validation logic. This attack leverages the possibility to encode potentially harmful input in UTF-8 and submit it to applications not expecting or effective at…TechniqueCAPEC-8022Buffer Overflow in an API CallThis attack targets libraries or shared code modules which are vulnerable to buffer overflow attacks. An adversary who has knowledge of known vulnerable libraries or shared code can easily target software that makes use of these libraries. …TechniqueCAPEC-823Using Slashes in Alternate EncodingThis attack targets the encoding of the Slash characters. An adversary would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, suc…TechniqueCAPEC-7924Using Escaped Slashes in Alternate EncodingThis attack targets the use of the backslash in alternate encoding. An adversary can provide a backslash as a leading character and causes a parser to believe that the next character is special. This is called an escape. By using that trick…TechniqueCAPEC-7825Manipulating User-Controlled VariablesThis attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitizatio…TechniqueCAPEC-7726Manipulating Web Input to File System CallsAn attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be…TechniqueCAPEC-7627Manipulating Writeable Configuration FilesGenerally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the appli…TechniqueCAPEC-7528Manipulating State{"p":["The adversary modifies state information maintained by the target software or causes a state transition in hardware. If successful, the target will use this tainted state and execute in an unintended manner.","State management is an …TechniqueCAPEC-7429User-Controlled FilenameAn attack of this type involves an adversary inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable c…TechniqueCAPEC-7330URL EncodingThis attack targets the encoding of the URL. An adversary can take advantage of the multiple way of encoding an URL and abuse the interpretation of the URL.TechniqueCAPEC-7231Using Unicode Encoding to Bypass Validation LogicAn attacker may provide a Unicode string to a system component that is not Unicode aware and use that to circumvent the filter or cause the classifying mechanism to fail to properly understanding the request. That may allow the attacker to …TechniqueCAPEC-7132Exploiting Incorrect Chaining or Granularity of Hardware Debug Components{"p":"An adversary exploits incorrect chaining or granularity of hardware debug components in order to gain unauthorized access to debug functionality on a chip. This happens when authorization is not checked on a per function basis and is …TechniqueCAPEC-70233Browser in the Middle (BiTM)An adversary exploits the inherent functionalities of a web browser, in order to establish an unnoticed remote desktop connection in the victim's browser to the adversary's system. The adversary must deploy a web client with a remote deskto…TechniqueCAPEC-70134Network Boundary BridgingAn adversary which has gained elevated access to network boundary devices may use these devices to create a channel to bridge trusted and untrusted networks. Boundary devices do not necessarily have to be on the network’s edge, but rather m…TechniqueCAPEC-70035Try Common or Default Usernames and PasswordsAn adversary may try certain common or default usernames and passwords to gain access into the system and perform unauthorized actions. An adversary may try an intelligent brute force using empty passwords, known vendor default credentials,…TechniqueCAPEC-7036Blind SQL InjectionBlind SQL Injection results from an insufficient mitigation for SQL Injection. Although suppressing database error messages are considered best practice, the suppression alone is not sufficient to prevent SQL Injection. Blind SQL Injection …TechniqueCAPEC-737Eavesdropping on a MonitorAn Adversary can eavesdrop on the content of an external monitor through the air without modifying any cable or installing software, just capturing this signal emitted by the cable or video port, with this the attacker will be able to impac…TechniqueCAPEC-69938Install Malicious Extension{"p":"An adversary directly installs or tricks a user into installing a malicious extension into existing trusted software, with the goal of achieving a variety of negative technical impacts."}TechniqueCAPEC-69839DHCP Spoofing{"p":"An adversary masquerades as a legitimate Dynamic Host Configuration Protocol (DHCP) server by spoofing DHCP traffic, with the goal of redirecting network traffic or denying service to DHCP."}TechniqueCAPEC-69740Load Value InjectionAn adversary exploits a hardware design flaw in a CPU implementation of transient instruction execution in which a faulting or assisted load instruction transiently forwards adversary-controlled data from microarchitectural buffers. By indu…TechniqueCAPEC-69641Repo Jacking{"p":"An adversary takes advantage of the redirect property of directly linked Version Control System (VCS) repositories to trick users into incorporating malicious code into their applications."}TechniqueCAPEC-69542System Location Discovery{"p":["An adversary collects information about the target system in an attempt to identify the system's geographical location.","Information gathered could include keyboard layout, system language, and timezone. This information may benefit…TechniqueCAPEC-69443StarJacking{"p":"An adversary spoofs software popularity metadata to deceive users into believing that a maliciously provided package is widely used and originates from a trusted source."}TechniqueCAPEC-69344Spoof Version Control System Commit Metadata{"p":"An adversary spoofs metadata pertaining to a Version Control System (VCS) (e.g., Git) repository's commits to deceive users into believing that the maliciously provided software is frequently maintained and originates from a trusted s…TechniqueCAPEC-69245Spoof Open-Source Software Metadata{"p":"An adversary spoofs open-source software metadata in an attempt to masquerade malicious software as popular, maintained, and trusted."}TechniqueCAPEC-69146Metadata Spoofing{"p":"An adversary alters the metadata of a resource (e.g., file, directory, repository, etc.) to present a malicious resource as legitimate/credible."}TechniqueCAPEC-69047Target Programs with Elevated PrivilegesThis attack targets programs running with elevated privileges. The adversary tries to leverage a vulnerability in the running program and get arbitrary code to execute with elevated privileges.TechniqueCAPEC-6948Exploitation of Firmware or ROM Code with Unpatchable VulnerabilitiesAn adversary may exploit vulnerable code (i.e., firmware or ROM) that is unpatchable. Unpatchable devices exist due to manufacturers intentionally or inadvertently designing devices incapable of updating their software. Additionally, with u…TechniqueCAPEC-68249Exploitation of Improperly Controlled Hardware Security Identifiers{"p":"An adversary takes advantage of missing or incorrectly configured security identifiers (e.g., tokens), which are used for access control within a System-on-Chip (SoC), to read/write data or execute a given action."}TechniqueCAPEC-68150Exploitation of Improperly Controlled Registers{"p":"An adversary exploits missing or incorrectly configured access control within registers to read/write data that is not meant to be obtained or modified by a user."}TechniqueCAPEC-68051Subvert Code-signing FacilitiesMany languages use code signing facilities to vouch for code's identity and to thus tie code to its assigned privileges within an environment. Subverting this mechanism can be instrumental in an attacker escalating privilege. Any means of s…TechniqueCAPEC-6852Exploitation of Improperly Configured or Implemented Memory Protections{"p":"An adversary takes advantage of missing or incorrectly configured access control within memory to read/write data or inject malicious code into said memory."}TechniqueCAPEC-67953System Build Data Maliciously Altered{"p":"During the system build process, the system is deliberately misconfigured by the alteration of the build data. Access to system configuration data files and build processes is susceptible to deliberate misconfiguration of the system."…TechniqueCAPEC-67854Server Motherboard Compromise{"p":"Malware is inserted in a server motherboard (e.g., in the flash memory) in order to alter server functionality from that intended. The development environment or hardware/software support activity environment is susceptible to an adve…TechniqueCAPEC-67755NoSQL Injection{"p":"An adversary targets software that constructs NoSQL statements based on user input or with parameters vulnerable to operator replacement in order to achieve a variety of technical impacts such as escalating privileges, bypassing authe…TechniqueCAPEC-67656Retrieve Data from Decommissioned Devices{"p":"An adversary obtains decommissioned, recycled, or discarded systems and devices that can include an organization’s intellectual property, employee data, and other types of controlled information. Systems and devices that have reached …TechniqueCAPEC-67557Design for FPGA Maliciously Altered{"p":"An adversary alters the functionality of a field-programmable gate array (FPGA) by causing an FPGA configuration memory chip reload in order to introduce a malicious function that could result in the FPGA performing or enabling malici…TechniqueCAPEC-67458Developer Signing Maliciously Altered Software{"p":["Software produced by a reputable developer is clandestinely infected with malicious code and then digitally signed by the unsuspecting developer, where the software has been altered via a compromised software development or build pro…TechniqueCAPEC-67359Malicious Code Implanted During Chip Programming{"p":"During the programming step of chip manufacture, an adversary with access and necessary technical skills maliciously alters a chip’s intended program logic to produce an effect intended by the adversary when the fully manufactured chi…TechniqueCAPEC-67260Requirements for ASIC Functionality Maliciously AlteredAn adversary with access to functional requirements for an application specific integrated circuit (ASIC), a chip designed/customized for a singular particular use, maliciously alters requirements derived from originating capability needs. …TechniqueCAPEC-67161Software Development Tools Maliciously AlteredAn adversary with the ability to alter tools used in a development environment causes software to be developed with maliciously modified tools. Such tools include requirements management and database tools, software design tools, configurat…TechniqueCAPEC-67062String Format Overflow in syslog()This attack targets applications and software that uses the syslog() function insecurely. If an application does not explicitely use a format string parameter in a call to syslog(), user input can be placed in the format string parameter le…TechniqueCAPEC-6763Alteration of a Software Update{"p":"An adversary with access to an organization’s software update infrastructure inserts malware into the content of an outgoing update to fielded systems where a wide range of malicious effects are possible. With the same level of access…TechniqueCAPEC-66964Key Negotiation of Bluetooth Attack (KNOB)An adversary can exploit a flaw in Bluetooth key negotiation allowing them to decrypt information sent between two devices communicating via Bluetooth. The adversary uses an Adversary in the Middle setup to modify packets sent between the t…TechniqueCAPEC-66865Bluetooth Impersonation AttackS (BIAS)An adversary disguises the MAC address of their Bluetooth enabled device to one for which there exists an active and trusted connection and authenticates successfully. The adversary can then perform malicious actions on the target Bluetooth…TechniqueCAPEC-66766BlueSmackingAn adversary uses Bluetooth flooding to transfer large packets to Bluetooth enabled devices over the L2CAP protocol with the goal of creating a DoS. This attack must be carried out within close proximity to a Bluetooth enabled device.TechniqueCAPEC-66667Exploitation of Thunderbolt Protection Flaws{"p":"An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verificatio…TechniqueCAPEC-66568Server Side Request Forgery{"p":"An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in th…TechniqueCAPEC-66469Exploitation of Transient Instruction ExecutionAn adversary exploits a hardware design flaw in a CPU implementation of transient instruction execution to expose sensitive data and bypass/subvert access control over restricted resources. Typically, the adversary conducts a covert channel…TechniqueCAPEC-66370Adversary in the Browser (AiTB){"p":"An adversary exploits security vulnerabilities or inherent functionalities of a web browser, in order to manipulate traffic between two endpoints."}TechniqueCAPEC-66271Root/Jailbreak Detection Evasion via DebuggingAn adversary inserts a debugger into the program entry point of a mobile application to modify the application binary, with the goal of evading Root/Jailbreak detection. Mobile device users often Root/Jailbreak their devices in order to gai…TechniqueCAPEC-66172Root/Jailbreak Detection Evasion via HookingAn adversary forces a non-restricted mobile application to load arbitrary code or code files, via Hooking, with the goal of evading Root/Jailbreak detection. Mobile device users often Root/Jailbreak their devices in order to gain administra…TechniqueCAPEC-66073SQL InjectionThis attack exploits target software that constructs SQL statements based on user input. An attacker crafts input strings so that when the target software constructs SQL statements based on the input, the resulting SQL statement performs ac…TechniqueCAPEC-6674Malicious Automated Software Update via SpoofingAn attackers uses identify or content spoofing to trick a client into performing an automated software update from a malicious source. A malicious automated software update that leverages spoofing can include content or identity spoofing as…TechniqueCAPEC-65775Voice PhishingAn adversary targets users with a phishing attack for the purpose of soliciting account passwords or sensitive information from the user. Voice Phishing is a variation of the Phishing social engineering technique where the attack is initiat…TechniqueCAPEC-65676Avoid Security Tool Identification by Adding Data{"p":["An adversary adds data to a file to increase the file size beyond what security tools are capable of handling in an attempt to mask their actions.","In addition to this, adding data to a file also changes the file's hash, frustrating…TechniqueCAPEC-65577Credential Prompt ImpersonationAn adversary, through a previously installed malicious application, impersonates a credential prompt in an attempt to steal a user's credentials.TechniqueCAPEC-65478Use of Known Operating System CredentialsAn adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or…TechniqueCAPEC-65379Use of Known Kerberos CredentialsAn adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or serv…TechniqueCAPEC-65280EavesdroppingAn adversary intercepts a form of communication (e.g. text, audio, video) by way of software (e.g., microphone and audio recording application), hardware (e.g., recording equipment), or physical means (e.g., physical proximity). The goal of…TechniqueCAPEC-65181Upload a Web Shell to a Web ServerBy exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web serve…TechniqueCAPEC-65082Sniff Application CodeAn adversary passively sniffs network communications and captures application code bound for an authorized client. Once obtained, they can use it as-is, or through reverse-engineering glean sensitive information or exploit the trust relatio…TechniqueCAPEC-6583Adding a Space to a File ExtensionAn adversary adds a space character to the end of a file extension and takes advantage of an application that does not properly neutralize trailing special elements in file names. This extra space, which can be difficult for a user to notic…TechniqueCAPEC-64984Collect Data from Screen CaptureAn adversary gathers sensitive information by exploiting the system's screen capture functionality. Through screenshots, the adversary aims to see what happens on the screen over the course of an operation. The adversary can leverage inform…TechniqueCAPEC-64885Collect Data from RegistriesAn adversary exploits a weakness in authorization to gather system-specific data and sensitive information within a registry (e.g., Windows Registry, Mac plist). These contain information about the system configuration, software, operating …TechniqueCAPEC-64786Peripheral FootprintingAdversaries may attempt to obtain information about attached peripheral devices and components connected to a computer system. Examples may include discovering the presence of iOS devices by searching for backups, analyzing the Windows regi…TechniqueCAPEC-64687Use of Captured Tickets (Pass The Ticket)An adversary uses stolen Kerberos tickets to access systems/resources that leverage the Kerberos authentication protocol. The Kerberos authentication protocol centers around a ticketing system which is used to request/grant access to servic…TechniqueCAPEC-64588Use of Captured Hashes (Pass The Hash)An adversary obtains (i.e. steals or purchases) legitimate Windows domain credential hash values to access systems within the domain that leverage the Lan Man (LM) and/or NT Lan Man (NTLM) authentication protocols.TechniqueCAPEC-64489Identify Shared Files/Directories on SystemAn adversary discovers connections between systems by exploiting the target system's standard practice of revealing them in searchable, common areas. Through the identification of shared folders/drives between systems, the adversary may fur…TechniqueCAPEC-64390Replace BinariesAdversaries know that certain binaries will be regularly executed as part of normal processing. If these binaries are not protected with the appropriate file system permissions, it could be possible to replace them with malware. This malwar…TechniqueCAPEC-64291DLL Side-LoadingAn adversary places a malicious version of a Dynamic-Link Library (DLL) in the Windows Side-by-Side (WinSxS) directory to trick the operating system into loading this malicious DLL instead of a legitimate DLL. Programs specify the location …TechniqueCAPEC-64192Inclusion of Code in Existing ProcessThe adversary takes advantage of a bug in an application failing to verify the integrity of the running process to execute arbitrary code in the address space of a separate live process. The adversary could use running code in the context o…TechniqueCAPEC-64093Using Slashes and URL Encoding Combined to Bypass Validation LogicThis attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special charact…TechniqueCAPEC-6494Probe System FilesAn adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for s…TechniqueCAPEC-63995Altered Component FirmwareAn adversary exploits systems features and/or improperly protected firmware of hardware components, such as Hard Disk Drives (HDD), with the goal of executing malicious code from within the component's Master Boot Record (MBR). Conducting t…TechniqueCAPEC-63896Collect Data from ClipboardThe adversary exploits an application that allows for the copying of sensitive data or information by collecting information copied to the clipboard. Data copied to the clipboard can be accessed by other applications, such as malware built …TechniqueCAPEC-63797Hiding Malicious Data or Code within FilesFiles on various operating systems can have a complex format which allows for the storage of other data, in addition to its contents. Often this is metadata about the file, such as a cached thumbnail for an image file. Unless utilities are …TechniqueCAPEC-63698Alternative Execution Due to Deceptive FilenamesThe extension of a file name is often used in various contexts to determine the application that is used to open and use it. If an attacker can cause an alternative application to be used, it may be able to execute malicious code, cause a d…TechniqueCAPEC-63599Probe Audio and Video PeripheralsThe adversary exploits the target system's audio and video functionalities through malware or scheduled tasks. The goal is to capture sensitive information about the target for financial, personal, political, or other gains which is accompl…TechniqueCAPEC-634100Token ImpersonationAn adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to…TechniqueCAPEC-633101Homograph Attack via HomoglyphsAn adversary registers a domain name containing a homoglyph, leading the registered domain to appear the same as a trusted domain. A homograph attack leverages the fact that different characters among various character sets look the same to…TechniqueCAPEC-632102SoundSquattingAn adversary registers a domain name that sounds the same as a trusted domain, but has a different spelling. A SoundSquatting attack takes advantage of a user's confusion of the two words to direct Internet traffic to adversary-controlled d…TechniqueCAPEC-631103TypoSquattingAn adversary registers a domain name with at least one character different than a trusted domain. A TypoSquatting attack takes advantage of instances where a user mistypes a URL (e.g. www.goggle.com) or not does visually verify a URL before…TechniqueCAPEC-630104Cross-Site Scripting (XSS)An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type …TechniqueCAPEC-63105DEPRECATED: Unauthorized Use of Device ResourcesThis attack pattern has been deprecated.TechniqueCAPEC-629106Carry-Off GPS AttackA common form of a GPS spoofing attack, commonly termed a carry-off attack begins with an adversary broadcasting signals synchronized with the genuine signals observed by the target receiver. The power of the counterfeit signals is then gra…TechniqueCAPEC-628107Counterfeit GPS SignalsAn adversary attempts to deceive a GPS receiver by broadcasting counterfeit GPS signals, structured to resemble a set of normal GPS signals. These spoofed signals may be structured in such a way as to cause the receiver to estimate its posi…TechniqueCAPEC-627108Smudge AttackAttacks that reveal the password/passcode pattern on a touchscreen device by detecting oil smudges left behind by the user’s fingers.TechniqueCAPEC-626109Mobile Device Fault InjectionFault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptogr…TechniqueCAPEC-625110Hardware Fault InjectionThe adversary uses disruptive signals or events, or alters the physical environment a device operates in, to cause faulty behavior in electronic devices. This can include electromagnetic pulses, laser pulses, clock glitches, ambient tempera…TechniqueCAPEC-624111Compromising Emanations AttackCompromising Emanations (CE) are defined as unintentional signals which an attacker may intercept and analyze to disclose the information processed by the targeted equipment. Commercial mobile devices and retransmission devices have display…TechniqueCAPEC-623112Electromagnetic Side-Channel AttackIn this attack scenario, the attacker passively monitors electromagnetic emanations that are produced by the targeted electronic device as an unintentional side-effect of its processing. From these emanations, the attacker derives informati…TechniqueCAPEC-622113Analysis of Packet Timing and SizesAn attacker may intercept and log encrypted transmissions for the purpose of analyzing metadata such as packet timing and sizes. Although the actual data may be encrypted, this metadata may reveal valuable information to an attacker. Note t…TechniqueCAPEC-621114Drop Encryption LevelAn attacker forces the encryption level to be lowered, thus enabling a successful attack against the encrypted data.TechniqueCAPEC-620115Cross Site Request ForgeryAn attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If …TechniqueCAPEC-62116Signal Strength TrackingIn this attack scenario, the attacker passively monitors the signal strength of the target’s cellular RF signal or WiFi RF signal and uses the strength of the signal (with directional antennas and/or from multiple listening points at once) …TechniqueCAPEC-619117Cellular Broadcast Message RequestIn this attack scenario, the attacker uses knowledge of the target’s mobile phone number (i.e., the number associated with the SIM used in the retransmission device) to cause the cellular network to send broadcast messages to alert the mobi…TechniqueCAPEC-618118Cellular Rogue Base StationIn this attack scenario, the attacker imitates a cellular base station with their own "rogue" base station equipment. Since cellular devices connect to whatever station has the strongest signal, the attacker can easily convince a targeted c…TechniqueCAPEC-617119Establish Rogue LocationAn adversary provides a malicious version of a resource at a location that is similar to the expected location of a legitimate resource. After establishing the rogue location, the adversary waits for a victim to visit the location and acces…TechniqueCAPEC-616120Evil Twin Wi-Fi AttackAdversaries install Wi-Fi equipment that acts as a legitimate Wi-Fi network access point. When a device connects to this access point, Wi-Fi data traffic is intercepted, captured, and analyzed. This also allows the adversary to use "adversa…TechniqueCAPEC-615121Rooting SIM CardsSIM cards are the de facto trust anchor of mobile devices worldwide. The cards protect the mobile identity of subscribers, associate devices with phone numbers, and increasingly store payment credentials, for example in NFC-enabled phones w…TechniqueCAPEC-614122WiFi SSID TrackingIn this attack scenario, the attacker passively listens for WiFi management frame messages containing the Service Set Identifier (SSID) for the WiFi network. These messages are frequently transmitted by WiFi access points (e.g., the retrans…TechniqueCAPEC-613123WiFi MAC Address TrackingIn this attack scenario, the attacker passively listens for WiFi messages and logs the associated Media Access Control (MAC) addresses. These addresses are intended to be unique to each wireless device (although they can be configured and c…TechniqueCAPEC-612124BitSquattingAn adversary registers a domain name one bit different than a trusted domain. A BitSquatting attack leverages random errors in memory to direct Internet traffic to adversary-controlled destinations. BitSquatting requires no exploitation or …TechniqueCAPEC-611125Cellular Data InjectionAdversaries inject data into mobile technology traffic (data flows or signaling data) to disrupt communications or conduct additional surveillance operations.TechniqueCAPEC-610126Session FixationThe attacker induces a client to establish a session with the target software using a session identifier provided by the attacker. Once the user successfully authenticates to the target software, the attacker uses the (now privileged) sessi…TechniqueCAPEC-61127Cellular Traffic InterceptCellular traffic for voice and data from mobile devices and retransmission devices can be intercepted via numerous methods. Malicious actors can deploy their own cellular tower equipment and intercept cellular traffic surreptitiously. Addit…TechniqueCAPEC-609128Cryptanalysis of Cellular EncryptionThe use of cryptanalytic techniques to derive cryptographic keys or otherwise effectively defeat cellular encryption to reveal traffic content. Some cellular encryption algorithms such as A5/1 and A5/2 (specified for GSM use) are known to b…TechniqueCAPEC-608129ObstructionAn attacker obstructs the interactions between system components. By interrupting or disabling these interactions, an adversary can often force the system into a degraded state or cause the system to stop working as intended. This can cause…TechniqueCAPEC-607130Weakening of Cellular EncryptionAn attacker, with control of a Cellular Rogue Base Station or through cooperation with a Malicious Mobile Network Operator can force the mobile device (e.g., the retransmission device) to use no encryption (A5/0 mode) or to use easily break…TechniqueCAPEC-606131Cellular JammingIn this attack scenario, the attacker actively transmits signals to overpower and disrupt the communication between a cellular user device and a cell tower. Several existing techniques are known in the open literature for this attack for 2G…TechniqueCAPEC-605132Wi-Fi JammingIn this attack scenario, the attacker actively transmits on the Wi-Fi channel to prevent users from transmitting or receiving data from the targeted Wi-Fi network. There are several known techniques to perform this attack – for example: the…TechniqueCAPEC-604133BlockageAn adversary blocks the delivery of an important system resource causing the system to fail or stop working.TechniqueCAPEC-603134DEPRECATED: DegradationThis attack pattern has been deprecated.TechniqueCAPEC-602135JammingAn adversary uses radio noise or signals in an attempt to disrupt communications. By intentionally overwhelming system resources with illegitimate traffic, service is denied to the legitimate traffic of authorized users.TechniqueCAPEC-601136Credential Stuffing{"p":"An adversary tries known username/password combinations against different systems, applications, or services to gain additional authenticated access. Credential Stuffing attacks rely upon the fact that many users leverage the same use…TechniqueCAPEC-600137Reusing Session IDs (aka Session Replay)This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Anothe…TechniqueCAPEC-60138Argument InjectionAn attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.TechniqueCAPEC-6139Terrestrial JammingIn this attack pattern, the adversary transmits disruptive signals in the direction of the target's consumer-level satellite dish (as opposed to the satellite itself). The transmission disruption occurs in a more targeted range. Portable te…TechniqueCAPEC-599140DNS SpoofingAn adversary sends a malicious ("NXDOMAIN" ("No such domain") code, or DNS A record) response to a target's route request before a legitimate resolver can. This technique requires an On-path or In-path device that can monitor and respond to…TechniqueCAPEC-598141Absolute Path TraversalAn adversary with access to file system resources, either directly or via application logic, will use various file absolute paths and navigation mechanisms such as ".." to extend their range of access to inappropriate areas of the file syst…TechniqueCAPEC-597142TCP RST InjectionAn adversary injects one or more TCP RST packets to a target after the target has made a HTTP GET request. The goal of this attack is to have the target and/or destination web server terminate the TCP connection.TechniqueCAPEC-596143Connection ResetIn this attack pattern, an adversary injects a connection reset packet to one or both ends of a target's connection. The attacker is therefore able to have the target and/or the destination server sever the connection without having to dire…TechniqueCAPEC-595144Traffic InjectionAn adversary injects traffic into the target's network connection. The adversary is therefore able to degrade or disrupt the connection, and potentially modify the content. This is not a flooding attack, as the adversary is not focusing on …TechniqueCAPEC-594145Session HijackingThis type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the…TechniqueCAPEC-593146Stored XSSAn adversary utilizes a form of Cross-site Scripting (XSS) where a malicious script is persistently "stored" within the data storage of a vulnerable web application as valid input.TechniqueCAPEC-592147Reflected XSSThis type of attack is a form of Cross-Site Scripting (XSS) where a malicious script is "reflected" off a vulnerable web application and then executed by a victim's browser. The process starts with an adversary delivering a malicious script…TechniqueCAPEC-591148IP Address BlockingAn adversary performing this type of attack drops packets destined for a target IP address. The aim is to prevent access to the service hosted at the target IP address.TechniqueCAPEC-590149Session Credential Falsification through PredictionThis attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.TechniqueCAPEC-59150DNS BlockingAn adversary intercepts traffic and intentionally drops DNS requests based on content in the request. In this way, the adversary can deny the availability of specific services or content to the user even if the IP address is changed.TechniqueCAPEC-589151DOM-Based XSSThis type of attack is a form of Cross-Site Scripting (XSS) where a malicious script is inserted into the client-side HTML being parsed by a web browser. Content served by a vulnerable web application includes script code used to manipulate…TechniqueCAPEC-588152Cross Frame Scripting (XFS)This attack pattern combines malicious Javascript and a legitimate webpage loaded into a concealed iframe. The malicious Javascript is then able to interact with a legitimate webpage in a manner that is unknown to the user. This attack usua…TechniqueCAPEC-587153Object InjectionAn adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for sav…TechniqueCAPEC-586154DNS Domain SeizureIn this attack pattern, an adversary influences a target's web-hosting company to disable a target domain. The goal is to prevent access to the targeted service provided by that domain. It usually occurs as the result of civil or criminal l…TechniqueCAPEC-585155BGP Route DisablingAn adversary suppresses the Border Gateway Protocol (BGP) advertisement for a route so as to render the underlying network inaccessible. The BGP protocol helps traffic move throughout the Internet by selecting the most efficient route betwe…TechniqueCAPEC-584156Disabling Network HardwareIn this attack pattern, an adversary physically disables networking hardware by powering it down or disconnecting critical equipment. Disabling or shutting off critical system resources prevents them from performing their service as intende…TechniqueCAPEC-583157Route DisablingAn adversary disables the network route between two targets. The goal is to completely sever the communications channel between two entities. This is often the result of a major error or the use of an "Internet kill switch" by those in cont…TechniqueCAPEC-582158Security Software FootprintingAdversaries may attempt to get a listing of security tools that are installed on the system and their configurations. This may include security related system features (such as a built-in firewall or anti-spyware) as well as third-party sec…TechniqueCAPEC-581159System FootprintingAn adversary engages in active probing and exploration activities to determine security information about a remote target system. Often times adversaries will rely on remote applications that can be probed for system configurations.TechniqueCAPEC-580160Restful Privilege ElevationAn adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting…TechniqueCAPEC-58161Replace Winlogon Helper DLLWinlogon is a part of Windows that performs logon actions. In Windows systems prior to Windows Vista, a registry key can be modified that causes Winlogon to load a DLL on startup. Adversaries may take advantage of this feature to load adver…TechniqueCAPEC-579162Disable Security SoftwareAn adversary exploits a weakness in access control to disable security tools so that detection does not occur. This can take the form of killing processes, deleting registry keys so that tools do not start at run time, deleting log files, o…TechniqueCAPEC-578163Owner FootprintingAn adversary exploits functionality meant to identify information about the primary users on the target system to an authorized user. They may do this, for example, by reviewing logins or file modification times. By knowing what owners use …TechniqueCAPEC-577164Group Permission FootprintingAn adversary exploits functionality meant to identify information about user groups and their permissions on the target system to an authorized user. By knowing what users/permissions are registered on the target system, the adversary can i…TechniqueCAPEC-576165Account FootprintingAn adversary exploits functionality meant to identify information about the domain accounts and their permissions on the target system to an authorized user. By knowing what accounts are registered on the target system, the adversary can in…TechniqueCAPEC-575166Services FootprintingAn adversary exploits functionality meant to identify information about the services on the target system to an authorized user. By knowing what services are registered on the target system, the adversary can learn about the target environm…TechniqueCAPEC-574167Process FootprintingAn adversary exploits functionality meant to identify information about the currently running processes on the target system to an authorized user. By knowing what processes are running on the target system, the adversary can learn about th…TechniqueCAPEC-573168Artificially Inflate File Sizes{"p":"An adversary modifies file contents by adding data to files for several reasons. Many different attacks could “follow” this pattern resulting in numerous outcomes. Adding data to a file could also result in a Denial of Service conditi…TechniqueCAPEC-572169Block Logging to Central Repository{"p":"An adversary prevents host-generated logs being delivered to a central location in an attempt to hide indicators of compromise."}TechniqueCAPEC-571170DEPRECATED: Signature-Based AvoidanceThis CAPEC has been deprecated because it is not directly related to a weakness, social engineering, supply chains, or a physical-based attack.TechniqueCAPEC-570171Utilizing REST's Trust in the System Resource to Obtain Sensitive DataThis attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.TechniqueCAPEC-57172Collect Data as Provided by UsersAn attacker leverages a tool, device, or program to obtain specific information as provided by a user of the target system. This information is often needed by the attacker to launch a follow-on attack. This attack is different than Social …TechniqueCAPEC-569173Capture Credentials via KeyloggerAn adversary deploys a keylogger in an effort to obtain credentials directly from a system's user. After capturing all the keystrokes made by a user, the adversary can analyze the data and determine which string are likely to be passwords o…TechniqueCAPEC-568174DEPRECATED: Obtain Data via UtilitiesThis CAPEC has been deprecated because it is not directly related to a weakness, social engineering, supply chains, or a physical-based attack.TechniqueCAPEC-567175DEPRECATED: Dump Password HashesThis CAPEC has been deprecated because of is not directly related to a weakness, social engineering, supply chains, or a physical-based attack.TechniqueCAPEC-566176Password Spraying{"p":"In a Password Spraying attack, an adversary tries a small list (e.g. 3-5) of common or expected passwords, often matching the target's complexity policy, against a known list of user accounts to gain valid credentials. The adversary t…TechniqueCAPEC-565177Run Software at LogonOperating system allows logon scripts to be run whenever a specific user or users logon to a system. If adversaries can access these scripts, they may insert additional code into the logon script. This code can allow them to maintain persis…TechniqueCAPEC-564178Add Malicious File to Shared WebrootAn adversaries may add malicious content to a website through the open file share and then browse to that content with a web browser to cause the server to execute the content. The malicious content will typically run under the context and …TechniqueCAPEC-563179Modify Shared FileAn adversary manipulates the files in a shared location by adding malicious programs, scripts, or exploit code to valid content. Once a user opens the shared content, the tainted content is executed.TechniqueCAPEC-562180Windows Admin Shares with Stolen CredentialsAn adversary guesses or obtains (i.e. steals or purchases) legitimate Windows administrator credentials (e.g. userID/password) to access Windows Admin Shares on a local machine or within a Windows domain.TechniqueCAPEC-561181Use of Known Domain Credentials{"p":"An adversary guesses or obtains (i.e. steals or purchases) legitimate credentials (e.g. userID/password) to achieve authentication and to perform authorized actions under the guise of an authenticated user or service."}TechniqueCAPEC-560182DEPRECATED: Removing/short-circuiting 'guard logic'This attack pattern has been deprecated as it is a duplicate of CAPEC-207 : Removing Important Client Functionality. Please refer to this other pattern going forward.TechniqueCAPEC-56183Orbital JammingIn this attack pattern, the adversary sends disruptive signals at a target satellite using a rogue uplink station to disrupt the intended transmission. Those within the satellite's footprint are prevented from reaching the satellite's targe…TechniqueCAPEC-559184Replace Trusted ExecutableAn adversary exploits weaknesses in privilege management or access control to replace a trusted executable with a malicious version and enable the execution of malware when that trusted executable is called.TechniqueCAPEC-558185DEPRECATED: Schedule Software To RunThis CAPEC has been deprecated because it is not directly related to a weakness, social engineering, supply chains, or a physical-based attack.TechniqueCAPEC-557186Replace File Extension HandlersWhen a file is opened, its file handler is checked to determine which program opens the file. File handlers are configuration properties of many operating systems. Applications can modify the file handler for a given file extension to call …TechniqueCAPEC-556187Remote Services with Stolen CredentialsThis pattern of attack involves an adversary that uses stolen credentials to leverage remote services such as RDP, telnet, SSH, and VNC to log into a system. Once access is gained, any number of malicious activities could be performed.TechniqueCAPEC-555188Functionality BypassAn adversary attacks a system by bypassing some or all functionality intended to protect it. Often, a system user will think that protection is in place, but the functionality behind those protections has been disabled by the adversary.TechniqueCAPEC-554189Install RootkitAn adversary exploits a weakness in authentication to install malware that alters the functionality and information provide by targeted operating system API calls. Often referred to as rootkits, it is often used to hide the presence of prog…TechniqueCAPEC-552190Modify Existing ServiceWhen an operating system starts, it also starts programs called services or daemons. Modifying existing services may break existing services or may enable services that are disabled/not commonly used.TechniqueCAPEC-551191Install New ServiceWhen an operating system starts, it also starts programs called services or daemons. Adversaries may install a new service which will be executed at startup (on a Windows system, by modifying the registry). The service name may be disguised…TechniqueCAPEC-550192Rainbow Table Password CrackingAn attacker gets access to the database table where hashes of passwords are stored. They then use a rainbow table of pre-computed hash chains to attempt to look up the original password. Once the original password corresponding to the hash …TechniqueCAPEC-55193Local Execution of CodeAn adversary installs and executes malicious code on the target system in an effort to achieve a negative technical impact. Examples include rootkits, ransomware, spyware, adware, and others.TechniqueCAPEC-549194Contaminate ResourceAn adversary contaminates organizational information systems (including devices and networks) by causing them to handle information of a classification/sensitivity for which they have not been authorized. When this happens, the contaminated…TechniqueCAPEC-548195Physical Destruction of Device or ComponentAn adversary conducts a physical attack a device or component, destroying it such that it no longer functions as intended.TechniqueCAPEC-547196Incomplete Data Deletion in a Multi-Tenant EnvironmentAn adversary obtains unauthorized information due to insecure or incomplete data deletion in a multi-tenant environment. If a cloud provider fails to completely delete storage and data from former cloud tenants' systems/resources, once thes…TechniqueCAPEC-546197Pull Data from System ResourcesAn adversary who is authorized or has the ability to search known system resources, does so with the intention of gathering useful information. System resources include files, memory, and other aspects of the target system. In this pattern …TechniqueCAPEC-545198Counterfeit OrganizationsAn adversary creates a false front organizations with the appearance of a legitimate supplier in the critical life cycle path that then injects corrupted/malicious information system components into the organizational supply chain.TechniqueCAPEC-544199Counterfeit WebsitesAdversary creates duplicates of legitimate websites. When users visit a counterfeit site, the site can gather information or upload malware.TechniqueCAPEC-543200Targeted MalwareAn adversary develops targeted malware that takes advantage of a known vulnerability in an organizational information technology environment. The malware crafted for these attacks is based specifically on information gathered about the tech…TechniqueCAPEC-542