CAPEC-3000 - 攻击模式详情 | CVE Find

厂商与产品

CPE（Common Platform Enumeration）是一种用于命名硬件、软件和操作系统的标准化方案。CPE 提供了一种结构化命名方案，可根据厂商、产品名称、版本、更新、版次和语言等属性唯一标识和分类信息技术系统、平台和软件包。

名称: Domains of Attack

This view organizes attack patterns hierarchically based on the attack domain.

CAPEC 成员

CAPEC-513: Software 类别

CAPEC-513: Attack patterns within this category focus on the exploitation of software applications. The techniques defined by each pattern are used to exploit these weaknesses in the application's design or implementation in an attempt to achieve a desired negative technical impact.

CAPEC-21: Exploitation of Trusted Identifiers 基础

CAPEC-22: Exploiting Trust in Client 基础

CAPEC-25: Forced Deadlock 基础

CAPEC-26: Leveraging Race Conditions 基础

CAPEC-28: Fuzzing 基础

CAPEC-74: Manipulating State 基础

CAPEC-94: Adversary in the Middle (AiTM) 基础

CAPEC-112: Brute Force 基础

CAPEC-113: Interface Manipulation 基础

CAPEC-114: Authentication Abuse 基础

CAPEC-115: Authentication Bypass 基础

CAPEC-116: Excavation 基础

CAPEC-117: Interception 基础

CAPEC-122: Privilege Abuse 基础

CAPEC-123: Buffer Manipulation 基础

CAPEC-124: Shared Resource Manipulation 基础

CAPEC-125: Flooding 基础

CAPEC-129: Pointer Manipulation 基础

CAPEC-130: Excessive Allocation 基础

CAPEC-131: Resource Leak Exposure 基础

CAPEC-137: Parameter Injection 基础

CAPEC-148: Content Spoofing 基础

CAPEC-151: Identity Spoofing 基础

CAPEC-153: Input Data Manipulation 基础

CAPEC-154: Resource Location Spoofing 基础

CAPEC-161: Infrastructure Manipulation 基础

CAPEC-165: File Manipulation 基础

CAPEC-169: Footprinting 基础

CAPEC-173: Action Spoofing 基础

CAPEC-175: Code Inclusion 基础

CAPEC-176: Configuration/Environment Manipulation 基础

CAPEC-184: Software Integrity Attack 基础

CAPEC-188: Reverse Engineering 基础

CAPEC-212: Functionality Misuse 基础

CAPEC-224: Fingerprinting 基础

CAPEC-227: Sustained Client Engagement 基础

CAPEC-233: Privilege Escalation 基础

CAPEC-240: Resource Injection 基础

CAPEC-242: Code Injection 基础

CAPEC-248: Command Injection 基础

CAPEC-272: Protocol Manipulation 基础

CAPEC-410: Information Elicitation 基础

CAPEC-438: Modification During Manufacture 基础

CAPEC-441: Malicious Logic Insertion 基础

CAPEC-548: Contaminate Resource 基础

CAPEC-549: Local Execution of Code 基础

CAPEC-554: Functionality Bypass 基础

CAPEC-560: Use of Known Domain Credentials 基础

CAPEC-586: Object Injection 基础

CAPEC-594: Traffic Injection 基础

CAPEC-607: Obstruction 基础

CAPEC-690: Metadata Spoofing 基础

CAPEC-515: Hardware 类别

CAPEC-515: Attack patterns within this category focus on the exploitation of the physical hardware used in computing systems. The techniques defined by each pattern reflect the replacement, destruction, modification and exploitation of hardware components that make up a system in an attempt to achieve a desired negative technical impact. Attacks against hardware component fall into several broad categories depending upon the relative sophistication of the attacker and the type of systems that are targeted. Attacks against hardware components differ from software attacks in that hardware-based attacks target the chips, circuit boards, device ports, or other components that comprise a computer system or embedded system. Sophisticated attacks may involve adding or removing jumpers to an exposed system, or applying sensors to portions of the motherboard to read data as it traverses the system bus.

CAPEC-26: Leveraging Race Conditions 基础

CAPEC-74: Manipulating State 基础

CAPEC-113: Interface Manipulation 基础

CAPEC-114: Authentication Abuse 基础

CAPEC-116: Excavation 基础

CAPEC-122: Privilege Abuse 基础

CAPEC-124: Shared Resource Manipulation 基础

CAPEC-148: Content Spoofing 基础

CAPEC-151: Identity Spoofing 基础

CAPEC-154: Resource Location Spoofing 基础

CAPEC-161: Infrastructure Manipulation 基础

CAPEC-176: Configuration/Environment Manipulation 基础

CAPEC-188: Reverse Engineering 基础

CAPEC-192: Protocol Analysis 基础

CAPEC-212: Functionality Misuse 基础

CAPEC-233: Privilege Escalation 基础

CAPEC-438: Modification During Manufacture 基础

CAPEC-439: Manipulation During Distribution 基础

CAPEC-440: Hardware Integrity Attack 基础

CAPEC-441: Malicious Logic Insertion 基础

CAPEC-548: Contaminate Resource 基础

CAPEC-560: Use of Known Domain Credentials 基础

CAPEC-607: Obstruction 基础

CAPEC-624: Hardware Fault Injection 基础

CAPEC-512: Communications 类别

CAPEC-512: Attack patterns within this category focus on the exploitation of communications and related protocols. The techniques defined by each pattern are used by an adversary to block, manipulate, and steal communications in an attempt to achieve a desired negative technical impact.

CAPEC-22: Exploiting Trust in Client 基础

CAPEC-94: Adversary in the Middle (AiTM) 基础

CAPEC-117: Interception 基础

CAPEC-125: Flooding 基础

CAPEC-130: Excessive Allocation 基础

CAPEC-148: Content Spoofing 基础

CAPEC-151: Identity Spoofing 基础

CAPEC-154: Resource Location Spoofing 基础

CAPEC-161: Infrastructure Manipulation 基础

CAPEC-169: Footprinting 基础

CAPEC-192: Protocol Analysis 基础

CAPEC-216: Communication Channel Manipulation 基础

CAPEC-240: Resource Injection 基础

CAPEC-272: Protocol Manipulation 基础

CAPEC-594: Traffic Injection 基础

CAPEC-607: Obstruction 基础

CAPEC-624: Hardware Fault Injection 基础

CAPEC-437: Supply Chain 类别

CAPEC-437: Attack patterns within this category focus on the disruption of the supply chain lifecycle by manipulating computer system hardware, software, or services for the purpose of espionage, theft of critical data or technology, or the disruption of mission-critical operations or infrastructure. Supply chain operations are usually multi-national with parts, components, assembly, and delivery occurring across multiple countries offering an attacker multiple points for disruption.

CAPEC-116: Excavation 基础

CAPEC-154: Resource Location Spoofing 基础

CAPEC-176: Configuration/Environment Manipulation 基础

CAPEC-184: Software Integrity Attack 基础

CAPEC-438: Modification During Manufacture 基础

CAPEC-439: Manipulation During Distribution 基础

CAPEC-440: Hardware Integrity Attack 基础

CAPEC-690: Metadata Spoofing 基础

CAPEC-403: Social Engineering 类别

CAPEC-403: Attack patterns within this category focus on the manipulation and exploitation of people. The techniques defined by each pattern are used to convince a target into performing actions or divulging confidential information that benefit the adversary, often resulting in access to computer systems or facilities. While similar to a confidence trick or simple fraud, the term typically applies to trickery or deception for the purpose of information gathering, fraud, or computer system access. In most cases, the adversary never comes face-to-face with the victim.

CAPEC-137: Parameter Injection 基础

CAPEC-151: Identity Spoofing 基础

CAPEC-154: Resource Location Spoofing 基础

CAPEC-173: Action Spoofing 基础

CAPEC-184: Software Integrity Attack 基础

CAPEC-410: Information Elicitation 基础

CAPEC-416: Manipulate Human Behavior 基础

CAPEC-607: Obstruction 基础

CAPEC-690: Metadata Spoofing 基础

CAPEC-514: Physical Security 类别

CAPEC-514: Attack patterns within this category focus on physical security. The techniques defined by each pattern are used to exploit weaknesses in the physical security of a system in an attempt to achieve a desired negative technical impact.

CAPEC-116: Excavation 基础

CAPEC-117: Interception 基础

CAPEC-188: Reverse Engineering 基础

CAPEC-390: Bypassing Physical Security 基础

CAPEC-440: Hardware Integrity Attack 基础

CAPEC-507: Physical Theft 基础

CAPEC-607: Obstruction 基础

CAPEC 信息

备注

When this view is fully expanded, only the immediate children (meta patterns) of the top level categories will be visible. Lower level children (standard and detailed patterns) can be accessed by opening up the meta CAPEC entries. This is a known issue and will be corrected in a future release.

提交记录

名称	组织	日期	发布日期
CAPEC Content Team	The MITRE Corporation	2014-06-23 +00:00

修改记录

名称	组织	日期	备注
CAPEC Content Team	The MITRE Corporation	2018-07-31 +00:00	Updated Other_Notes