名前: Mechanisms of Attack

This view organizes attack patterns hierarchically based on mechanisms that are frequently employed when exploiting a vulnerability. The categories that are members of this view represent the different techniques used to attack a system. They do not, however, represent the consequences or goals of the attacks. There exists the potential for some attack patterns to align with more than one category depending on one’s perspective. To counter this, emphasis was placed such that attack patterns as presented within each category use a technique not sometimes, but without exception.

CAPEC メンバー

CAPEC-156: Engage in Deceptive Interactions カテゴリ

CAPEC-156: Attack patterns within this category focus on malicious interactions with a target in an attempt to deceive the target and convince the target that it is interacting with some other principal and as such take actions based on the level of trust that exists between the target and the other principal. These types of attacks assume that some piece of content or functionality is associated with an identity and that the content / functionality is trusted by the target because of this association. Often identified by the term "spoofing", these types of attacks rely on the falsification of the content and/or identity in such a way that the target will incorrectly trust the legitimacy of the content. For example, an attacker may modify a financial transaction between two parties so that the participants remain unchanged but the amount of the transaction is increased. If the recipient cannot detect the change, they may incorrectly assume the modified message originated with the original sender. Attacks of these type may involve an adversary crafting the content from scratch or capturing and modifying legitimate content.

CAPEC-148: Content Spoofing ベース

CAPEC-151: Identity Spoofing ベース

CAPEC-154: Resource Location Spoofing ベース

CAPEC-173: Action Spoofing ベース

CAPEC-416: Manipulate Human Behavior ベース

CAPEC-690: Metadata Spoofing ベース

CAPEC-210: Abuse Existing Functionality カテゴリ

CAPEC-210: An adversary uses or manipulates one or more functions of an application in order to achieve a malicious objective not originally intended by the application, or to deplete a resource to the point that the target's functionality is affected. This is a broad class of attacks wherein the adversary is able to alter the intended result or purpose of the functionality and thereby affect application behavior or information integrity. Outcomes can range from information exposure, vandalism, degrading or denial of service, as well as execution of arbitrary code on the target machine.

CAPEC-113: Interface Manipulation ベース

CAPEC-125: Flooding ベース

CAPEC-130: Excessive Allocation ベース

CAPEC-131: Resource Leak Exposure ベース

CAPEC-212: Functionality Misuse ベース

CAPEC-216: Communication Channel Manipulation ベース

CAPEC-227: Sustained Client Engagement ベース

CAPEC-272: Protocol Manipulation ベース

CAPEC-554: Functionality Bypass ベース

CAPEC-255: Manipulate Data Structures カテゴリ

CAPEC-255: Attack patterns in this category manipulate and exploit characteristics of system data structures in order to violate the intended usage and protections of these structures. This is done in such a way that yields either improper access to the associated system data or violations of the security properties of the system itself due to vulnerabilities in how the system processes and manages the data structures. Often, vulnerabilities and therefore exploitability of these data structures exist due to ambiguity and assumption in their design and prescribed handling.

CAPEC-123: Buffer Manipulation ベース

CAPEC-124: Shared Resource Manipulation ベース

CAPEC-129: Pointer Manipulation ベース

CAPEC-153: Input Data Manipulation ベース

CAPEC-262: Manipulate System Resources カテゴリ

CAPEC-262: Attack patterns within this category focus on the adversary's ability to manipulate one or more resources in order to achieve a desired outcome. This is a broad class of attacks wherein the attacker is able to change some aspect of a resource's state or availability and thereby affect system behavior or information integrity. Examples of resources include files, applications, libraries, infrastructure, and configuration information. Outcomes can range from vandalism and reduction in service to the execution of arbitrary code on the target machine.

CAPEC-184: Software Integrity Attack ベース

CAPEC-440: Hardware Integrity Attack ベース

CAPEC-161: Infrastructure Manipulation ベース

CAPEC-165: File Manipulation ベース

CAPEC-176: Configuration/Environment Manipulation ベース

CAPEC-607: Obstruction ベース

CAPEC-438: Modification During Manufacture ベース

CAPEC-439: Manipulation During Distribution ベース

CAPEC-441: Malicious Logic Insertion ベース

CAPEC-548: Contaminate Resource ベース

CAPEC-152: Inject Unexpected Items カテゴリ

CAPEC-152: Attack patterns within this category focus on the ability to control or disrupt the behavior of a target either through crafted data submitted via an interface for data input, or the installation and execution of malicious code on the target system. The former happens when an adversary adds material to their input that is interpreted by the application causing the targeted application to perform steps unintended by the application manager or causing the application to enter an unstable state. Attacks of this type differ from Data Structure Attacks in that the latter attacks subvert the underlying structures that hold user-provided data, either pre-empting interpretation of the input (in the case of Buffer Overflows) or resulting in values that the targeted application is unable to handle correctly (in the case of Integer Overflows). In Injection attacks, the input is interpreted by the application, but the attacker has included instructions to the interpreting functions that the target application then follows.

CAPEC-137: Parameter Injection ベース

CAPEC-175: Code Inclusion ベース

CAPEC-240: Resource Injection ベース

CAPEC-242: Code Injection ベース

CAPEC-248: Command Injection ベース

CAPEC-549: Local Execution of Code ベース

CAPEC-624: Hardware Fault Injection ベース

CAPEC-594: Traffic Injection ベース

CAPEC-586: Object Injection ベース

CAPEC-223: Employ Probabilistic Techniques カテゴリ

CAPEC-223: An attacker utilizes probabilistic techniques to explore and overcome security properties of the target that are based on an assumption of strength due to the extremely low mathematical probability that an attacker would be able to identify and exploit the very rare specific conditions under which those security properties do not hold.

CAPEC-112: Brute Force ベース

CAPEC-28: Fuzzing ベース

CAPEC-172: Manipulate Timing and State カテゴリ

CAPEC-172: An attacker exploits weaknesses in timing or state maintaining functions to perform actions that would otherwise be prevented by the execution flow of the target code and processes. An example of a state attack might include manipulation of an application's information to change the apparent credentials or similar information, possibly allowing the application to access material it would not normally be allowed to access. A common example of a timing attack is a test-action race condition where some state information is tested and, if it passes, an action is performed. If the attacker can change the state between the time that the application performs the test and the time the action is performed, then they might be able to manipulate the outcome of the action to malicious ends.

CAPEC-25: Forced Deadlock ベース

CAPEC-26: Leveraging Race Conditions ベース

CAPEC-74: Manipulating State ベース

CAPEC-118: Collect and Analyze Information カテゴリ

CAPEC-118: Attack patterns within this category focus on the gathering, collection, and theft of information by an adversary. The adversary may collect this information through a variety of methods including active querying as well as passive observation. By exploiting weaknesses in the design or configuration of the target and its communications, an adversary is able to get the target to reveal more information than intended. Information retrieved may aid the adversary in making inferences about potential weaknesses, vulnerabilities, or techniques that assist the adversary's objectives. This information may include details regarding the configuration or capabilities of the target, clues as to the timing or nature of activities, or otherwise sensitive information. Often this sort of attack is undertaken in preparation for some other type of attack, although the collection of information by itself may in some cases be the end goal of the adversary.

CAPEC-116: Excavation ベース

CAPEC-117: Interception ベース

CAPEC-169: Footprinting ベース

CAPEC-224: Fingerprinting ベース

CAPEC-188: Reverse Engineering ベース

CAPEC-192: Protocol Analysis ベース

CAPEC-410: Information Elicitation ベース

CAPEC-225: Subvert Access Control カテゴリ

CAPEC-225: An attacker actively targets exploitation of weaknesses, limitations and assumptions in the mechanisms a target utilizes to manage identity and authentication as well as manage access to its resources or authorize functionality. Such exploitation can lead to the complete subversion of any trust the target system may have in the identity of any entity with which it interacts, or the complete subversion of any control the target has over its data or functionality. Weaknesses targeted by subversion of authorization controls are often due to three primary factors: 1) a fundamental dependence on authentication mechanisms being effective; 2) a lack of effective control over the separation of privilege between various entities; and 3) assumptions and over confidence in the strength or rigor of the implemented authorization mechanisms.

CAPEC-21: Exploitation of Trusted Identifiers ベース

CAPEC-114: Authentication Abuse ベース

CAPEC-115: Authentication Bypass ベース

CAPEC-22: Exploiting Trust in Client ベース

CAPEC-94: Adversary in the Middle (AiTM) ベース

CAPEC-122: Privilege Abuse ベース

CAPEC-233: Privilege Escalation ベース

CAPEC-390: Bypassing Physical Security ベース

CAPEC-507: Physical Theft ベース

CAPEC-560: Use of Known Domain Credentials ベース

CAPEC の情報

登録情報

名前	組織	日付	リリース日
CAPEC Content Team	The MITRE Corporation	2014-06-23 +00:00

変更履歴

名前	組織	日付	コメント
CAPEC Content Team	The MITRE Corporation	2015-11-09 +00:00	Updated View_Objective
CAPEC Content Team	The MITRE Corporation	2017-01-09 +00:00	Updated Relationships, View_Objective

CAPEC-1000 ビュー詳細

CAPEC-1000