Zeros312
CAPEC-1 | Accessing Functionality Not Properly Constrained by ACLs | Standard | Draft | High | High | In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to. | {'id': '1', 'attrs': {'ID': '1', 'Name': 'Accessing Functionality Not Properly Constrained by ACLs', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 52f79ef1d77c7e51171e6b3a0c4b7dd0c0ec7d1c5cfeb4c177a8acd1c8e3135a | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-10 | Buffer Overflow via Environment Variables | Detailed | Draft | High | High | This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the adversary finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables. | Although the focus of this attack is putting excessive content into an environment variable that is loaded into a buffer, environment variables can be used to assist a classic buffer overflow attack as well. In the case where the buffer used in a traditional buffer overflow attack is not large enough to store the adversary's shell code, they will store the shell code in an environment variable and attempt to return to its address, rather than back into the data they wrote to the buffer. | {'id': '10', 'attrs': {'ID': '10', 'Name': 'Buffer Overflow via Environment Variables', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | ee5a6940575f1432845789bf28318cd349932781afc51030d022db84f9e615ef | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 |
CAPEC-100 | Overflow Buffers | Standard | Draft | High | Very High | Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an adversary. As a consequence, an adversary is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the adversaries' choice. | {'id': '100', 'attrs': {'ID': '100', 'Name': 'Overflow Buffers', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 8d68cddcf9078a770d2de53f225f73c7f1117689826163e2bb69290c94f27b24 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-101 | Server Side Include (SSI) Injection | Detailed | Draft | High | High | An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands. | {'id': '101', 'attrs': {'ID': '101', 'Name': 'Server Side Include (SSI) Injection', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | c1cf65d299408f9a72390cc2ae40c454be04a8d9b6e3ec414bb1fab59e2aa963 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-102 | Session Sidejacking | Detailed | Draft | High | High | Session sidejacking takes advantage of an unencrypted communication channel between a victim and target system. The attacker sniffs traffic on a network looking for session tokens in unencrypted traffic. Once a session token is captured, the attacker performs malicious actions by using the stolen token with the targeted application to impersonate the victim. This attack is a specific method of session hijacking, which is exploiting a valid session token to gain unauthorized access to a target system or information. Other methods to perform a session hijacking are session fixation, cross-site scripting, or compromising a user or server machine and stealing the session token. | {'id': '102', 'attrs': {'ID': '102', 'Name': 'Session Sidejacking', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | b7302e75e9e20e26428e350ab89722c4d47f5f2bc25dd028dc9e641f8ead63da | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-103 | Clickjacking | Standard | Draft | Medium | High | An adversary tricks a victim into unknowingly initiating some action in one system while interacting with the UI from a seemingly completely different, usually an adversary controlled or intended, system. | {'id': '103', 'attrs': {'ID': '103', 'Name': 'Clickjacking', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 59ee7173434e8f4dd89b1a60ab9bf65e8509008f556fc81679190550176f4abb | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-104 | Cross Zone Scripting | Standard | Draft | Medium | High | An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. | {'id': '104', 'attrs': {'ID': '104', 'Name': 'Cross Zone Scripting', 'Status': 'Draft', 'Abstraction': 'Standard'}} | fad8253229df035374d36347d0be291ad6b29a71fc1c9df1bed109060ad4a60f | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-105 | HTTP Request Splitting | Detailed | Stable | Medium | High | {'id': '105', 'attrs': {'ID': '105', 'Name': 'HTTP Request Splitting', 'Status': 'Stable', 'Abstraction': 'Detailed'}} | f8aed9d276a7807f7f251becff789a29792ebe025488cbcfbff81d86d9b9b35a | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-106 | DEPRECATED: XSS through Log Files | Detailed | Deprecated | This attack pattern has been deprecated as it referes to an existing chain relationship between "CAPEC-93 : Log Injection-Tampering-Forging" and "CAPEC-63 : Cross-Site Scripting". Please refer to these CAPECs going forward. | {'id': '106', 'attrs': {'ID': '106', 'Name': 'DEPRECATED: XSS through Log Files', 'Status': 'Deprecated', 'Abstraction': 'Detailed'}} | 020d3efbe72290c07d02fbab1f37a049645865262402183121977d1f980efb4d | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |||
CAPEC-107 | Cross Site Tracing | Detailed | Draft | Medium | Very High | Cross Site Tracing (XST) enables an adversary to steal the victim's session cookie and possibly other authentication credentials transmitted in the header of the HTTP request when the victim's browser communicates to a destination system's web server. | {'id': '107', 'attrs': {'ID': '107', 'Name': 'Cross Site Tracing', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 3580f966ebe7c385b933ebfb23c4482728db33b9131508d6059dc5680d63f6af | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-16 | Dictionary-based Password Attack | Detailed | Draft | Medium | High | {'id': '16', 'attrs': {'ID': '16', 'Name': 'Dictionary-based Password Attack', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 6cdd5a0b53af75a35fc34175c4478bf8537a17f85112607f39677916621d638b | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-257 | DEPRECATED: Abuse of Transaction Data Structure | Meta | Deprecated | This attack pattern has been deprecated as it was deemed not to be a legitimate attack pattern. | {'id': '257', 'attrs': {'ID': '257', 'Name': 'DEPRECATED: Abuse of Transaction Data Structure', 'Status': 'Deprecated', 'Abstraction': 'Meta'}} | cfa1dff71b4a1bf75fa27395d85b86893bd27bb8f7a877bd82980873bb178b4e | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |||
CAPEC-108 | Command Line Execution through SQL Injection | Detailed | Draft | Low | Very High | An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host. | {'id': '108', 'attrs': {'ID': '108', 'Name': 'Command Line Execution through SQL Injection', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | ad009166c590a6cab64868ae080d942db1bb3d16dd26c2212632b4d2d8163f94 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-109 | Object Relational Mapping Injection | Detailed | Draft | Low | High | An attacker leverages a weakness present in the database access layer code generated with an Object Relational Mapping (ORM) tool or a weakness in the way that a developer used a persistence framework to inject their own SQL commands to be executed against the underlying database. The attack here is similar to plain SQL injection, except that the application does not use JDBC to directly talk to the database, but instead it uses a data access layer generated by an ORM tool or framework (e.g. Hibernate). While most of the time code generated by an ORM tool contains safe access methods that are immune to SQL injection, sometimes either due to some weakness in the generated code or due to the fact that the developer failed to use the generated access methods properly, SQL injection is still possible. | {'id': '109', 'attrs': {'ID': '109', 'Name': 'Object Relational Mapping Injection', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 77b3f4979b7a69624cf586589dc28c0a5d5ab86717521bb6f89edcad08150533 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-11 | Cause Web Server Misclassification | Detailed | Draft | Medium | High | An attack of this type exploits a Web server's decision to take action based on filename or file extension. Because different file types are handled by different server processes, misclassification may force the Web server to take unexpected action, or expected actions in an unexpected sequence. This may cause the server to exhaust resources, supply debug or system data to the attacker, or bind an attacker to a remote process. | {'id': '11', 'attrs': {'ID': '11', 'Name': 'Cause Web Server Misclassification', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 00d1f119ab36be22661f2b99d9ab74b81a1391346a6fd47905701995c825da5c | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-110 | SQL Injection through SOAP Parameter Tampering | Detailed | Draft | High | Very High | An attacker modifies the parameters of the SOAP message that is sent from the service consumer to the service provider to initiate a SQL injection attack. On the service provider side, the SOAP message is parsed and parameters are not properly validated before being used to access a database in a way that does not use parameter binding, thus enabling the attacker to control the structure of the executed SQL query. This pattern describes a SQL injection attack with the delivery mechanism being a SOAP message. | {'id': '110', 'attrs': {'ID': '110', 'Name': 'SQL Injection through SOAP Parameter Tampering', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | d8a0de8ffafc2cae6791ae021edfc99d0795e697e49128c16f3c0668118a017a | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-111 | JSON Hijacking (aka JavaScript Hijacking) | Standard | Draft | High | High | An attacker targets a system that uses JavaScript Object Notation (JSON) as a transport mechanism between the client and the server (common in Web 2.0 systems using AJAX) to steal possibly confidential information transmitted from the server back to the client inside the JSON object by taking advantage of the loophole in the browser's Same Origin Policy that does not prohibit JavaScript from one website to be included and executed in the context of another website. | {'id': '111', 'attrs': {'ID': '111', 'Name': 'JSON Hijacking (aka JavaScript Hijacking)', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 95270ac7fc7ec8773fe25f4e7039ac83e714fa97a3466d10dee662f7a734ab52 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-112 | Brute Force | Meta | Draft | High | In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. | {'id': '112', 'attrs': {'ID': '112', 'Name': 'Brute Force', 'Status': 'Draft', 'Abstraction': 'Meta'}} | 10e318cd6c61ef77c7c6838576690df67d63b5919e1fe194973683e84df4dd07 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-113 | Interface Manipulation | Meta | Draft | Medium | Medium | An adversary manipulates the use or processing of an interface (e.g. Application Programming Interface (API) or System-on-Chip (SoC)) resulting in an adverse impact upon the security of the system implementing the interface. This can allow the adversary to bypass access control and/or execute functionality not intended by the interface implementation, possibly compromising the system which integrates the interface. Interface manipulation can take on a number of forms including forcing the unexpected use of an interface or the use of an interface in an unintended way. | {'id': '113', 'attrs': {'ID': '113', 'Name': 'Interface Manipulation', 'Status': 'Draft', 'Abstraction': 'Meta'}} | 08a5744be21087d8c03a6fe5a33296edbf92ee78aaf0b07f65d57de2ee701ca1 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-114 | Authentication Abuse | Meta | Draft | Medium | An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker. | {'id': '114', 'attrs': {'ID': '114', 'Name': 'Authentication Abuse', 'Status': 'Draft', 'Abstraction': 'Meta'}} | 9c5276bc01499274d85e04085e418bb2a87dee619ff8eed3790d68f3dd816caa | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-115 | Authentication Bypass | Meta | Draft | Medium | An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. | {'id': '115', 'attrs': {'ID': '115', 'Name': 'Authentication Bypass', 'Status': 'Draft', 'Abstraction': 'Meta'}} | d011a4b48c4520e979b204a762452375bf7b07d51273e0b274e1e2399006507f | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-116 | Excavation | Meta | Stable | High | Medium | An adversary actively probes the target in a manner that is designed to solicit information that could be leveraged for malicious purposes. | {'id': '116', 'attrs': {'ID': '116', 'Name': 'Excavation', 'Status': 'Stable', 'Abstraction': 'Meta'}} | 4a8b34e249bf86a20ba510cd9898989cc3bf283d104758b28eca5475d8608590 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-117 | Interception | Meta | Stable | Low | Medium | An adversary monitors data streams to or from the target for information gathering purposes. This attack may be undertaken to solely gather sensitive information or to support a further attack against the target. This attack pattern can involve sniffing network traffic as well as other types of data streams (e.g. radio). The adversary can attempt to initiate the establishment of a data stream or passively observe the communications as they unfold. In all variants of this attack, the adversary is not the intended recipient of the data stream. In contrast to other means of gathering information (e.g., targeting data leaks), the adversary must actively position themself so as to observe explicit data channels (e.g. network traffic) and read the content. However, this attack differs from a Adversary-In-the-Middle (CAPEC-94) attack, as the adversary does not alter the content of the communications nor forward data to the intended recipient. | {'id': '117', 'attrs': {'ID': '117', 'Name': 'Interception', 'Status': 'Stable', 'Abstraction': 'Meta'}} | 03d58ab4f5f487c4e44ad780553882a57f2becc008148081d8cf71db6ed6232a | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-12 | Choosing Message Identifier | Standard | Draft | High | High | This pattern of attack is defined by the selection of messages distributed via multicast or public information channels that are intended for another client by determining the parameter value assigned to that client. This attack allows the adversary to gain access to potentially privileged information, and to possibly perpetrate other attacks through the distribution means by impersonation. If the channel/message being manipulated is an input rather than output mechanism for the system, (such as a command bus), this style of attack could be used to change the adversary's identifier to more a privileged one. | {'id': '12', 'attrs': {'ID': '12', 'Name': 'Choosing Message Identifier', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 428c9ce9967f5c1f3b49d238f7044521f42184d18ac14ff462cc33e8af919426 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-120 | Double Encoding | Detailed | Draft | Low | Medium | The adversary utilizes a repeating of the encoding process for a set of characters (that is, character encoding a character encoding of a character) to obfuscate the payload of a particular request. This may allow the adversary to bypass filters that attempt to detect illegal characters or strings, such as those that might be used in traversal or injection attacks. Filters may be able to catch illegal encoded strings, but may not catch doubly encoded strings. For example, a dot (.), often used in path traversal attacks and therefore often blocked by filters, could be URL encoded as %2E. However, many filters recognize this encoding and would still block the request. In a double encoding, the % in the above URL encoding would be encoded again as %25, resulting in %252E which some filters might not catch, but which could still be interpreted as a dot (.) by interpreters on the target. | {'id': '120', 'attrs': {'ID': '120', 'Name': 'Double Encoding', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | d2aaa528c2e57b6b57e685d630c5ffaf40e20c9872f358b370e79e41a7c2bf42 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-121 | Exploit Non-Production Interfaces | Standard | Stable | Low | High | {'id': '121', 'attrs': {'ID': '121', 'Name': 'Exploit Non-Production Interfaces', 'Status': 'Stable', 'Abstraction': 'Standard'}} | 3f800c10922c8153152f9127c8ce5724dc54be7a4a7d2a3b3846602c051de9f0 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-122 | Privilege Abuse | Meta | Draft | High | Medium | An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. | {'id': '122', 'attrs': {'ID': '122', 'Name': 'Privilege Abuse', 'Status': 'Draft', 'Abstraction': 'Meta'}} | 93298f5258478890a66cd6bdd2e37d6f8abd8e85193948316dd4f322c444a336 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-123 | Buffer Manipulation | Meta | Draft | High | Very High | An adversary manipulates an application's interaction with a buffer in an attempt to read or modify data they shouldn't have access to. Buffer attacks are distinguished in that it is the buffer space itself that is the target of the attack rather than any code responsible for interpreting the content of the buffer. In virtually all buffer attacks the content that is placed in the buffer is immaterial. Instead, most buffer attacks involve retrieving or providing more input than can be stored in the allocated buffer, resulting in the reading or overwriting of other unintended program memory. | {'id': '123', 'attrs': {'ID': '123', 'Name': 'Buffer Manipulation', 'Status': 'Draft', 'Abstraction': 'Meta'}} | e735bc6c56c892305c2863e73a4ad22e2e9976c659912e5c4d760331e098bd8f | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-124 | Shared Resource Manipulation | Meta | Draft | Medium | An adversary exploits a resource shared between multiple applications, an application pool or hardware pin multiplexing to affect behavior. Resources may be shared between multiple applications or between multiple threads of a single application. Resource sharing is usually accomplished through mutual access to a single memory location or multiplexed hardware pins. If an adversary can manipulate this shared resource (usually by co-opting one of the applications or threads) the other applications or threads using the shared resource will often continue to trust the validity of the compromised shared resource and use it in their calculations. This can result in invalid trust assumptions, corruption of additional data through the normal operations of the other users of the shared resource, or even cause a crash or compromise of the sharing applications. | {'id': '124', 'attrs': {'ID': '124', 'Name': 'Shared Resource Manipulation', 'Status': 'Draft', 'Abstraction': 'Meta'}} | 25799334f1ea34d5f1acaff8043427e966e728b9486a0a00f15e5a51d29ade3e | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-125 | Flooding | Meta | Stable | High | Medium | An adversary consumes the resources of a target by rapidly engaging in a large number of interactions with the target. This type of attack generally exposes a weakness in rate limiting or flow. When successful this attack prevents legitimate users from accessing the service and can cause the target to crash. This attack differs from resource depletion through leaks or allocations in that the latter attacks do not rely on the volume of requests made to the target but instead focus on manipulation of the target's operations. The key factor in a flooding attack is the number of requests the adversary can make in a given period of time. The greater this number, the more likely an attack is to succeed against a given target. | {'id': '125', 'attrs': {'ID': '125', 'Name': 'Flooding', 'Status': 'Stable', 'Abstraction': 'Meta'}} | b4ce02186f35c53f1fcd6526a3dc5230d8a9622364d662d9b403dfef758189ec | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-184 | Software Integrity Attack | Meta | Draft | Low | An attacker initiates a series of events designed to cause a user, program, server, or device to perform actions which undermine the integrity of software code, device data structures, or device firmware, achieving the modification of the target's integrity to achieve an insecure state. | {'id': '184', 'attrs': {'ID': '184', 'Name': 'Software Integrity Attack', 'Status': 'Draft', 'Abstraction': 'Meta'}} | d76cec953b3f263cca194c9087e33920b34e8e7d22c8bf8c2ab444c5b3c2739a | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-126 | Path Traversal | Standard | Draft | High | Very High | An adversary uses path manipulation methods to exploit insufficient input validation of a target to obtain access to data that should be not be retrievable by ordinary well-formed requests. A typical variety of this attack involves specifying a path to a desired file together with dot-dot-slash characters, resulting in the file access API or function traversing out of the intended directory structure and into the root file system. By replacing or modifying the expected path information the access function or API retrieves the file desired by the attacker. These attacks either involve the attacker providing a complete path to a targeted file or using control characters (e.g. path separators (/ or \) and/or dots (.)) to reach desired directories or files. | {'id': '126', 'attrs': {'ID': '126', 'Name': 'Path Traversal', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 42baf9b4fb61f6ce8ceeba262a1e483aae4681f6bbad02780592819b6d943d4c | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-127 | Directory Indexing | Detailed | Draft | High | Medium | An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks. | {'id': '127', 'attrs': {'ID': '127', 'Name': 'Directory Indexing', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | c787b5b3e67f2e259e005e9d741c2135e98f59806fdac39fa84dd53689a3f6b3 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-128 | Integer Attacks | Standard | Draft | Medium | An attacker takes advantage of the structure of integer variables to cause these variables to assume values that are not expected by an application. For example, adding one to the largest positive integer in a signed integer variable results in a negative number. Negative numbers may be illegal in an application and the application may prevent an attacker from providing them directly, but the application may not consider that adding two positive numbers can create a negative number do to the structure of integer storage formats. | {'id': '128', 'attrs': {'ID': '128', 'Name': 'Integer Attacks', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 96956edddbe935ff6f82304bccfc379f525674599dcfc0252051f78f3409f138 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-129 | Pointer Manipulation | Meta | Draft | Medium | This attack pattern involves an adversary manipulating a pointer within a target application resulting in the application accessing an unintended memory location. This can result in the crashing of the application or, for certain pointer values, access to data that would not normally be possible or the execution of arbitrary code. Since pointers are simply integer variables, Integer Attacks may often be used in Pointer Attacks. | {'id': '129', 'attrs': {'ID': '129', 'Name': 'Pointer Manipulation', 'Status': 'Draft', 'Abstraction': 'Meta'}} | d041e3dff726c6ee4a4ca30a819144c29b6e3699343fb1ba054d4a771b5239a3 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-13 | Subverting Environment Variable Values | Detailed | Stable | High | Very High | The adversary directly or indirectly modifies environment variables used by or controlling the target software. The adversary's goal is to cause the target software to deviate from its expected operation in a manner that benefits the adversary. | {'id': '13', 'attrs': {'ID': '13', 'Name': 'Subverting Environment Variable Values', 'Status': 'Stable', 'Abstraction': 'Detailed'}} | 1f1a2ce58263ff533eee7a961ebb46cb206480563926761a60b87e87054b0657 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-130 | Excessive Allocation | Meta | Stable | Medium | Medium | An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources. This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request. | {'id': '130', 'attrs': {'ID': '130', 'Name': 'Excessive Allocation', 'Status': 'Stable', 'Abstraction': 'Meta'}} | 8828b997dcff15b375adefde629db9946781ecb43ee0622a68302ddaa088a4ef | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-131 | Resource Leak Exposure | Meta | Stable | Medium | Medium | An adversary utilizes a resource leak on the target to deplete the quantity of the resource available to service legitimate requests. | {'id': '131', 'attrs': {'ID': '131', 'Name': 'Resource Leak Exposure', 'Status': 'Stable', 'Abstraction': 'Meta'}} | 16c988e267382be18e0d531442f683cb68a0cba56b296a43f36cf91663cc5e80 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-132 | Symlink Attack | Detailed | Draft | Low | High | An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name. | {'id': '132', 'attrs': {'ID': '132', 'Name': 'Symlink Attack', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 41c582cb8634c7a7ccd5a50825c6b965162aafcbd015a73cb50574dc012551bf | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-133 | Try All Common Switches | Standard | Draft | Medium | An attacker attempts to invoke all common switches and options in the target application for the purpose of discovering weaknesses in the target. For example, in some applications, adding a --debug switch causes debugging information to be displayed, which can sometimes reveal sensitive processing or configuration information to an attacker. This attack differs from other forms of API abuse in that the attacker is indiscriminately attempting to invoke options in the hope that one of them will work rather than specifically targeting a known option. Nonetheless, even if the attacker is familiar with the published options of a targeted application this attack method may still be fruitful as it might discover unpublicized functionality. | {'id': '133', 'attrs': {'ID': '133', 'Name': 'Try All Common Switches', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 01e54d23b6bf228a31f18892fe3b2d3c71c861bcf6c01d1eb35e34aaa67fa40b | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-134 | Email Injection | Standard | Draft | Medium | An adversary manipulates the headers and content of an email message by injecting data via the use of delimiter characters native to the protocol. | {'id': '134', 'attrs': {'ID': '134', 'Name': 'Email Injection', 'Status': 'Draft', 'Abstraction': 'Standard'}} | b75cfde87cd41ad047d5e6b5e47e52d17deaf1248a5fbb8f79eb38c8983a85a0 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-135 | Format String Injection | Standard | Draft | High | High | An adversary includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the memory. An adversary can use this to read or write to memory locations or files, or simply to manipulate the value of the resulting text in unexpected ways. Reading or writing memory may result in program crashes and writing memory could result in the execution of arbitrary code if the adversary can write to the program stack. | {'id': '135', 'attrs': {'ID': '135', 'Name': 'Format String Injection', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 674dfd2dfa99a7f9463ceba528e76ba1415229ac0cf005a20209ef987d13ff62 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-136 | LDAP Injection | Standard | Draft | High | High | An attacker manipulates or crafts an LDAP query for the purpose of undermining the security of the target. Some applications use user input to create LDAP queries that are processed by an LDAP server. For example, a user might provide their username during authentication and the username might be inserted in an LDAP query during the authentication process. An attacker could use this input to inject additional commands into an LDAP query that could disclose sensitive information. For example, entering a * in the aforementioned query might return information about all users on the system. This attack is very similar to an SQL injection attack in that it manipulates a query to gather additional information or coerce a particular return value. | {'id': '136', 'attrs': {'ID': '136', 'Name': 'LDAP Injection', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 40e83af67622b3c33a8246d972415cb339d625daa405fe34d7065701cb25af56 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-137 | Parameter Injection | Meta | Stable | Medium | Medium | An adversary manipulates the content of request parameters for the purpose of undermining the security of the target. Some parameter encodings use text characters as separators. For example, parameters in a HTTP GET message are encoded as name-value pairs separated by an ampersand (&). If an attacker can supply text strings that are used to fill in these parameters, then they can inject special characters used in the encoding scheme to add or modify parameters. For example, if user input is fed directly into an HTTP GET request and the user provides the value "myInput&new_param=myValue", then the input parameter is set to myInput, but a new parameter (new_param) is also added with a value of myValue. This can significantly change the meaning of the query that is processed by the server. Any encoding scheme where parameters are identified and separated by text characters is potentially vulnerable to this attack - the HTTP GET encoding used above is just one example. | {'id': '137', 'attrs': {'ID': '137', 'Name': 'Parameter Injection', 'Status': 'Stable', 'Abstraction': 'Meta'}} | 62620b1c47ff6620b8bce1c2d52ce26d781851f0b7b8d7a6b444b287b99218f5 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-138 | Reflection Injection | Standard | Draft | Very High | An adversary supplies a value to the target application which is then used by reflection methods to identify a class, method, or field. For example, in the Java programming language the reflection libraries permit an application to inspect, load, and invoke classes and their components by name. If an adversary can control the input into these methods including the name of the class/method/field or the parameters passed to methods, they can cause the targeted application to invoke incorrect methods, read random fields, or even to load and utilize malicious classes that the adversary created. This can lead to the application revealing sensitive information, returning incorrect results, or even having the adversary take control of the targeted application. | {'id': '138', 'attrs': {'ID': '138', 'Name': 'Reflection Injection', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 687c74ff96e8beb653113ebdd55609a93302651f04cd3f56992e69a336c319ef | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-139 | Relative Path Traversal | Detailed | Draft | High | High | An attacker exploits a weakness in input validation on the target by supplying a specially constructed path utilizing dot and slash characters for the purpose of obtaining access to arbitrary files or resources. An attacker modifies a known path on the target in order to reach material that is not available through intended channels. These attacks normally involve adding additional path separators (/ or \) and/or dots (.), or encodings thereof, in various combinations in order to reach parent directories or entirely separate trees of the target's directory structure. | {'id': '139', 'attrs': {'ID': '139', 'Name': 'Relative Path Traversal', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 10c7857644b702fdd0b9242e01923fe6da118d7855bd49889ef5b4a29a157475 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-14 | Client-side Injection-induced Buffer Overflow | Detailed | Draft | Medium | High | This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service. This hostile service is created to deliver the correct content to the client software. For example, if the client-side application is a browser, the service will host a webpage that the browser loads. | {'id': '14', 'attrs': {'ID': '14', 'Name': 'Client-side Injection-induced Buffer Overflow', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 470e5af2684807713d9c17a4aa13431acde409a4ec8510f1c62860916b25fb4c | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-140 | Bypassing of Intermediate Forms in Multiple-Form Sets | Standard | Draft | Medium | Some web applications require users to submit information through an ordered sequence of web forms. This is often done if there is a very large amount of information being collected or if information on earlier forms is used to pre-populate fields or determine which additional information the application needs to collect. An attacker who knows the names of the various forms in the sequence may be able to explicitly type in the name of a later form and navigate to it without first going through the previous forms. This can result in incomplete collection of information, incorrect assumptions about the information submitted by the attacker, or other problems that can impair the functioning of the application. | {'id': '140', 'attrs': {'ID': '140', 'Name': 'Bypassing of Intermediate Forms in Multiple-Form Sets', 'Status': 'Draft', 'Abstraction': 'Standard'}} | df9f0ecdbeb917ecfd7d41989cbb46e3ab44e10b77e228fa5d08e8830b6151f0 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-185 | Malicious Software Download | Standard | Draft | Very High | An attacker uses deceptive methods to cause a user or an automated process to download and install dangerous code that originates from an attacker controlled source. There are several variations to this strategy of attack. | {'id': '185', 'attrs': {'ID': '185', 'Name': 'Malicious Software Download', 'Status': 'Draft', 'Abstraction': 'Standard'}} | f8f15d07f7c7ab809fb03ac4e39d769e14154edc1c7a0c1429fbbb6bc54d9680 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-141 | Cache Poisoning | Standard | Draft | High | High | An attacker exploits the functionality of cache technologies to cause specific data to be cached that aids the attackers' objectives. This describes any attack whereby an attacker places incorrect or harmful material in cache. The targeted cache can be an application's cache (e.g. a web browser cache) or a public cache (e.g. a DNS or ARP cache). Until the cache is refreshed, most applications or clients will treat the corrupted cache value as valid. This can lead to a wide range of exploits including redirecting web browsers towards sites that install malware and repeatedly incorrect calculations based on the incorrect value. | {'id': '141', 'attrs': {'ID': '141', 'Name': 'Cache Poisoning', 'Status': 'Draft', 'Abstraction': 'Standard'}} | d1b2585881ff15d4cc0b1cccc00c531db2bd34de19d3d47a86eb39b62a1b93ed | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-142 | DNS Cache Poisoning | Detailed | Draft | High | High | A domain name server translates a domain name (such as www.example.com) into an IP address that Internet hosts use to contact Internet resources. An adversary modifies a public DNS cache to cause certain names to resolve to incorrect addresses that the adversary specifies. The result is that client applications that rely upon the targeted cache for domain name resolution will be directed not to the actual address of the specified domain name but to some other address. Adversaries can use this to herd clients to sites that install malware on the victim's computer or to masquerade as part of a Pharming attack. | {'id': '142', 'attrs': {'ID': '142', 'Name': 'DNS Cache Poisoning', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 24af032e0b609b7057e8cd8823ac7dc208b6e424ba241ece9ca602f188ecf931 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-143 | Detect Unpublicized Web Pages | Detailed | Draft | Low | An adversary searches a targeted web site for web pages that have not been publicized. In doing this, the adversary may be able to gain access to information that the targeted site did not intend to make public. | {'id': '143', 'attrs': {'ID': '143', 'Name': 'Detect Unpublicized Web Pages', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | cffc360316054b61875d6ac794907a5f3dee1dda80605bf902369e1611db5d2a | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-144 | Detect Unpublicized Web Services | Detailed | Draft | Low | An adversary searches a targeted web site for web services that have not been publicized. This attack can be especially dangerous since unpublished but available services may not have adequate security controls placed upon them given that an administrator may believe they are unreachable. | {'id': '144', 'attrs': {'ID': '144', 'Name': 'Detect Unpublicized Web Services', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 8c7a71ec7dad4b8d44f5732b1c2925fd44444050d1b8950937295a9927a44b30 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-145 | Checksum Spoofing | Detailed | Draft | Medium | An adversary spoofs a checksum message for the purpose of making a payload appear to have a valid corresponding checksum. Checksums are used to verify message integrity. They consist of some value based on the value of the message they are protecting. Hash codes are a common checksum mechanism. Both the sender and recipient are able to compute the checksum based on the contents of the message. If the message contents change between the sender and recipient, the sender and recipient will compute different checksum values. Since the sender's checksum value is transmitted with the message, the recipient would know that a modification occurred. In checksum spoofing an adversary modifies the message body and then modifies the corresponding checksum so that the recipient's checksum calculation will match the checksum (created by the adversary) in the message. This would prevent the recipient from realizing that a change occurred. | {'id': '145', 'attrs': {'ID': '145', 'Name': 'Checksum Spoofing', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 5e3f8b2facd024da3c8584acc87927c7da4a8a30fbbf0105872db472b4161efe | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-146 | XML Schema Poisoning | Detailed | Stable | Low | High | An adversary corrupts or modifies the content of XML schema information passed between a client and server for the purpose of undermining the security of the target. XML Schemas provide the structure and content definitions for XML documents. Schema poisoning is the ability to manipulate a schema either by replacing or modifying it to compromise the programs that process documents that use this schema. | {'id': '146', 'attrs': {'ID': '146', 'Name': 'XML Schema Poisoning', 'Status': 'Stable', 'Abstraction': 'Detailed'}} | 08af068364fc3b6bce7aee6d2b955f19c58cc19c2e42d9a8f42c5705d95cb084 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-147 | XML Ping of the Death | Detailed | Draft | Low | Medium | An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target. | {'id': '147', 'attrs': {'ID': '147', 'Name': 'XML Ping of the Death', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 80e4e9d10da8f57eeb223f34c64124173b6a6ab686a8c1f190e40fe62d2c857b | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-148 | Content Spoofing | Meta | Stable | Medium | Medium | An adversary modifies content to make it contain something other than what the original content producer intended while keeping the apparent source of the content unchanged. The term content spoofing is most often used to describe modification of web pages hosted by a target to display the adversary's content instead of the owner's content. However, any content can be spoofed, including the content of email messages, file transfers, or the content of other network communication protocols. Content can be modified at the source (e.g. modifying the source file for a web page) or in transit (e.g. intercepting and modifying a message between the sender and recipient). Usually, the adversary will attempt to hide the fact that the content has been modified, but in some cases, such as with web site defacement, this is not necessary. Content Spoofing can lead to malware exposure, financial fraud (if the content governs financial transactions), privacy violations, and other unwanted outcomes. | {'id': '148', 'attrs': {'ID': '148', 'Name': 'Content Spoofing', 'Status': 'Stable', 'Abstraction': 'Meta'}} | 156415adf6a51a4a565d3722343616cb6d9c0dc84fc39e63cc2c243a8aaf4e98 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-149 | Explore for Predictable Temporary File Names | Detailed | Draft | Medium | An attacker explores a target to identify the names and locations of predictable temporary files for the purpose of launching further attacks against the target. This involves analyzing naming conventions and storage locations of the temporary files created by a target application. If an attacker can predict the names of temporary files they can use this information to mount other attacks, such as information gathering and symlink attacks. | {'id': '149', 'attrs': {'ID': '149', 'Name': 'Explore for Predictable Temporary File Names', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 868620f88562a0c7774b48a5badc2c438d3cb6d3f11a70c90791aa00808644d0 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-15 | Command Delimiters | Standard | Draft | High | High | An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on. | {'id': '15', 'attrs': {'ID': '15', 'Name': 'Command Delimiters', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 9609d741d6c5053985e658693bb9822b6c59e265f82abf0260f76fd0aac13ec3 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-150 | Collect Data from Common Resource Locations | Standard | Draft | Medium | An adversary exploits well-known locations for resources for the purposes of undermining the security of the target. In many, if not most systems, files and resources are organized in a default tree structure. This can be useful for adversaries because they often know where to look for resources or files that are necessary for attacks. Even when the precise location of a targeted resource may not be known, naming conventions may indicate a small area of the target machine's file tree where the resources are typically located. For example, configuration files are normally stored in the /etc director on Unix systems. Adversaries can take advantage of this to commit other types of attacks. | {'id': '150', 'attrs': {'ID': '150', 'Name': 'Collect Data from Common Resource Locations', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 7d5d6f864d7b4967f7de357de5173d751435aa89d2d2b759e9f1c801d5ecd765 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-151 | Identity Spoofing | Meta | Stable | Medium | Medium | Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. | {'id': '151', 'attrs': {'ID': '151', 'Name': 'Identity Spoofing', 'Status': 'Stable', 'Abstraction': 'Meta'}} | d519975a03163912bac0d35d2013f769dcdc2305da71c2cc0588551d279dc69d | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-153 | Input Data Manipulation | Meta | Draft | Medium | An attacker exploits a weakness in input validation by controlling the format, structure, and composition of data to an input-processing interface. By supplying input of a non-standard or unexpected form an attacker can adversely impact the security of the target. | {'id': '153', 'attrs': {'ID': '153', 'Name': 'Input Data Manipulation', 'Status': 'Draft', 'Abstraction': 'Meta'}} | 1164a52f47cbbddd6095e25ad8b2a310f6d0a026024467737eed105d48293e72 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-154 | Resource Location Spoofing | Meta | Stable | Medium | Medium | An adversary deceives an application or user and convinces them to request a resource from an unintended location. By spoofing the location, the adversary can cause an alternate resource to be used, often one that the adversary controls and can be used to help them achieve their malicious goals. | {'id': '154', 'attrs': {'ID': '154', 'Name': 'Resource Location Spoofing', 'Status': 'Stable', 'Abstraction': 'Meta'}} | 84292b1acb592aaccff10c3baee8f1e35944967b54c8a79e009973a77a059c9a | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-155 | Screen Temporary Files for Sensitive Information | Detailed | Draft | Medium | Medium | An adversary exploits the temporary, insecure storage of information by monitoring the content of files used to store temp data during an application's routine execution flow. Many applications use temporary files to accelerate processing or to provide records of state across multiple executions of the application. Sometimes, however, these temporary files may end up storing sensitive information. By screening an application's temporary files, an adversary might be able to discover such sensitive information. For example, web browsers often cache content to accelerate subsequent lookups. If the content contains sensitive information then the adversary could recover this from the web cache. | {'id': '155', 'attrs': {'ID': '155', 'Name': 'Screen Temporary Files for Sensitive Information', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 692ddc3ffd73342f9c63c7212949590163257904459fdf2822b23ccf5d57ed84 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-157 | Sniffing Attacks | Standard | Draft | Medium | In this attack pattern, the adversary intercepts information transmitted between two third parties. The adversary must be able to observe, read, and/or hear the communication traffic, but not necessarily block the communication or change its content. Any transmission medium can theoretically be sniffed if the adversary can examine the contents between the sender and recipient. Sniffing Attacks are similar to Adversary-In-The-Middle attacks (CAPEC-94), but are entirely passive. AiTM attacks are predominantly active and often alter the content of the communications themselves. | {'id': '157', 'attrs': {'ID': '157', 'Name': 'Sniffing Attacks', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 5b7bb212634c1116476b93d213c4ed094cea65217895ccbeb5857cbc6cea6a4c | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-158 | Sniffing Network Traffic | Detailed | Draft | Medium | In this attack pattern, the adversary monitors network traffic between nodes of a public or multicast network in an attempt to capture sensitive information at the protocol level. Network sniffing applications can reveal TCP/IP, DNS, Ethernet, and other low-level network communication information. The adversary takes a passive role in this attack pattern and simply observes and analyzes the traffic. The adversary may precipitate or indirectly influence the content of the observed transaction, but is never the intended recipient of the target information. | {'id': '158', 'attrs': {'ID': '158', 'Name': 'Sniffing Network Traffic', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 63d48bf75410f57745820f364c982336e44d52be8c8e5f9d47b6a312d769d066 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-159 | Redirect Access to Libraries | Standard | Stable | High | Very High | An adversary exploits a weakness in the way an application searches for external libraries to manipulate the execution flow to point to an adversary supplied library or code base. This pattern of attack allows the adversary to compromise the application or server via the execution of unauthorized code. An application typically makes calls to functions that are a part of libraries external to the application. These libraries may be part of the operating system or they may be third party libraries. If an adversary can redirect an application's attempts to access these libraries to other libraries that the adversary supplies, the adversary will be able to force the targeted application to execute arbitrary code. This is especially dangerous if the targeted application has enhanced privileges. Access can be redirected through a number of techniques, including the use of symbolic links, search path modification, and relative path manipulation. | {'id': '159', 'attrs': {'ID': '159', 'Name': 'Redirect Access to Libraries', 'Status': 'Stable', 'Abstraction': 'Standard'}} | 45e3f99ee8398b0f7f06f2e8a1ab962de3c535dfa957059cc2c4fafd9243b8df | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-160 | Exploit Script-Based APIs | Standard | Draft | Medium | Some APIs support scripting instructions as arguments. Methods that take scripted instructions (or references to scripted instructions) can be very flexible and powerful. However, if an attacker can specify the script that serves as input to these methods they can gain access to a great deal of functionality. For example, HTML pages support <script> tags that allow scripting languages to be embedded in the page and then interpreted by the receiving web browser. If the content provider is malicious, these scripts can compromise the client application. Some applications may even execute the scripts under their own identity (rather than the identity of the user providing the script) which can allow attackers to perform activities that would otherwise be denied to them. | {'id': '160', 'attrs': {'ID': '160', 'Name': 'Exploit Script-Based APIs', 'Status': 'Draft', 'Abstraction': 'Standard'}} | ad8dd1f68b10be3c267d4cd415b4ffe565900918e988d361c91856ae38d204c2 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-161 | Infrastructure Manipulation | Meta | Draft | High | An attacker exploits characteristics of the infrastructure of a network entity in order to perpetrate attacks or information gathering on network objects or effect a change in the ordinary information flow between network objects. Most often, this involves manipulation of the routing of network messages so, instead of arriving at their proper destination, they are directed towards an entity of the attackers' choosing, usually a server controlled by the attacker. The victim is often unaware that their messages are not being processed correctly. For example, a targeted client may believe they are connecting to their own bank but, in fact, be connecting to a Pharming site controlled by the attacker which then collects the user's login information in order to hijack the actual bank account. | {'id': '161', 'attrs': {'ID': '161', 'Name': 'Infrastructure Manipulation', 'Status': 'Draft', 'Abstraction': 'Meta'}} | 3ff049e954db865d4251e74d79aa48257ca0863cebb8ecab5b9c528252043421 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-162 | Manipulating Hidden Fields | Detailed | Draft | High | An adversary exploits a weakness in the server's trust of client-side processing by modifying data on the client-side, such as price information, and then submitting this data to the server, which processes the modified data. For example, eShoplifting is a data manipulation attack against an on-line merchant during a purchasing transaction. The manipulation of price, discount or quantity fields in the transaction message allows the adversary to acquire items at a lower cost than the merchant intended. The adversary performs a normal purchasing transaction but edits hidden fields within the HTML form response that store price or other information to give themselves a better deal. The merchant then uses the modified pricing information in calculating the cost of the selected items. | {'id': '162', 'attrs': {'ID': '162', 'Name': 'Manipulating Hidden Fields', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 2e0c523486e85107587f563fb9debe4730aa0f575cfe3215f3d00489db108243 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-163 | Spear Phishing | Detailed | Draft | High | High | An adversary targets a specific user or group with a Phishing (CAPEC-98) attack tailored to a category of users in order to have maximum relevance and deceptive capability. Spear Phishing is an enhanced version of the Phishing attack targeted to a specific user or group. The quality of the targeted email is usually enhanced by appearing to come from a known or trusted entity. If the email account of some trusted entity has been compromised the message may be digitally signed. The message will contain information specific to the targeted users that will enhance the probability that they will follow the URL to the compromised site. For example, the message may indicate knowledge of the targets employment, residence, interests, or other information that suggests familiarity. As soon as the user follows the instructions in the message, the attack proceeds as a standard Phishing attack. | {'id': '163', 'attrs': {'ID': '163', 'Name': 'Spear Phishing', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 4aac11f273bc6f645b106bb95e564ff51f164f463d43cdc3ab3a79ea52798bd4 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-164 | Mobile Phishing | Detailed | Stable | High | High | An adversary targets mobile phone users with a phishing attack for the purpose of soliciting account passwords or sensitive information from the user. Mobile Phishing is a variation of the Phishing social engineering technique where the attack is initiated via a text or SMS message, rather than email. The user is enticed to provide information or visit a compromised web site via this message. Apart from the manner in which the attack is initiated, the attack proceeds as a standard Phishing attack. | {'id': '164', 'attrs': {'ID': '164', 'Name': 'Mobile Phishing', 'Status': 'Stable', 'Abstraction': 'Detailed'}} | 3d509aeb523366d5bcd7b206d92ed6b71ae453cb42a9e1cbf186be7a0e1ee6d6 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-165 | File Manipulation | Meta | Draft | Medium | An attacker modifies file contents or attributes (such as extensions or names) of files in a manner to cause incorrect processing by an application. Attackers use this class of attacks to cause applications to enter unstable states, overwrite or expose sensitive information, and even execute arbitrary code with the application's privileges. This class of attacks differs from attacks on configuration information (even if file-based) in that file manipulation causes the file processing to result in non-standard behaviors, such as buffer overflows or use of the incorrect interpreter. Configuration attacks rely on the application interpreting files correctly in order to insert harmful configuration information. Likewise, resource location attacks rely on controlling an application's ability to locate files, whereas File Manipulation attacks do not require the application to look in a non-default location, although the two classes of attacks are often combined. | {'id': '165', 'attrs': {'ID': '165', 'Name': 'File Manipulation', 'Status': 'Draft', 'Abstraction': 'Meta'}} | 87763095b09d2dc637caf469ba12b20fcfdcab43025a3d84c965527ef2c859b2 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-166 | Force the System to Reset Values | Standard | Draft | Medium | An attacker forces the target into a previous state in order to leverage potential weaknesses in the target dependent upon a prior configuration or state-dependent factors. Even in cases where an attacker may not be able to directly control the configuration of the targeted application, they may be able to reset the configuration to a prior state since many applications implement reset functions. | {'id': '166', 'attrs': {'ID': '166', 'Name': 'Force the System to Reset Values', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 1fd5ecf4605882589ebe63feedb349167868519cbaf5eaea9455583b2ca397a1 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-167 | White Box Reverse Engineering | Standard | Draft | Medium | An attacker discovers the structure, function, and composition of a type of computer software through white box analysis techniques. White box techniques involve methods which can be applied to a piece of software when an executable or some other compiled object can be directly subjected to analysis, revealing at least a portion of its machine instructions that can be observed upon execution. | {'id': '167', 'attrs': {'ID': '167', 'Name': 'White Box Reverse Engineering', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 0238f4f861ee7d396e00562449d8e7cde320aef8a36a14ec46f0b1e24625ecec | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-168 | Windows ::DATA Alternate Data Stream | Detailed | Draft | Medium | An attacker exploits the functionality of Microsoft NTFS Alternate Data Streams (ADS) to undermine system security. ADS allows multiple "files" to be stored in one directory entry referenced as filename:streamname. One or more alternate data streams may be stored in any file or directory. Normal Microsoft utilities do not show the presence of an ADS stream attached to a file. The additional space for the ADS is not recorded in the displayed file size. The additional space for ADS is accounted for in the used space on the volume. An ADS can be any type of file. ADS are copied by standard Microsoft utilities between NTFS volumes. ADS can be used by an attacker or intruder to hide tools, scripts, and data from detection by normal system utilities. Many anti-virus programs do not check for or scan ADS. Windows Vista does have a switch (-R) on the command line DIR command that will display alternate streams. | {'id': '168', 'attrs': {'ID': '168', 'Name': 'Windows ::DATA Alternate Data Stream', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 142cef51ab57ec38cba9b90e8f3844c92a09e286d8a3a8a521cc82be9630f4f2 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-169 | Footprinting | Meta | Stable | High | Very Low | An adversary engages in probing and exploration activities to identify constituents and properties of the target. | {'id': '169', 'attrs': {'ID': '169', 'Name': 'Footprinting', 'Status': 'Stable', 'Abstraction': 'Meta'}} | 9d7f5b36baa69d0eedfd3c6607e5df968ae7e287d974a3f4b1ed1ce070b29b33 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-17 | Using Malicious Files | Standard | Draft | High | Very High | An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface. | {'id': '17', 'attrs': {'ID': '17', 'Name': 'Using Malicious Files', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 38d573a68382dd57a4c9f6384f5bce9f92ae98c1fb5b67bde8a2de07624a5b4c | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-170 | Web Application Fingerprinting | Detailed | Draft | High | Low | An attacker sends a series of probes to a web application in order to elicit version-dependent and type-dependent behavior that assists in identifying the target. An attacker could learn information such as software versions, error pages, and response headers, variations in implementations of the HTTP protocol, directory structures, and other similar information about the targeted service. This information can then be used by an attacker to formulate a targeted attack plan. While web application fingerprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks. | {'id': '170', 'attrs': {'ID': '170', 'Name': 'Web Application Fingerprinting', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 83ad2c362b68b0be0d84b569a3195baa2da06d10766fb19417ed4dd72d6886d4 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-171 | DEPRECATED: Variable Manipulation | Meta | Deprecated | This attack pattern has been deprecated as it is a duplicate of the existing attack pattern "CAPEC-77 : Manipulating User-Controlled Variables". Please refer to this other CAPEC going forward. | {'id': '171', 'attrs': {'ID': '171', 'Name': 'DEPRECATED: Variable Manipulation', 'Status': 'Deprecated', 'Abstraction': 'Meta'}} | 75e9de70f3f1423ee570b410f9dc888d2f3664b0d7716a18cc84441b122a2266 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |||
CAPEC-173 | Action Spoofing | Meta | Stable | High | Very High | An adversary is able to disguise one action for another and therefore trick a user into initiating one type of action when they intend to initiate a different action. For example, a user might be led to believe that clicking a button will submit a query, but in fact it downloads software. Adversaries may perform this attack through social means, such as by simply convincing a victim to perform the action or relying on a user's natural inclination to do so, or through technical means, such as a clickjacking attack where a user sees one interface but is actually interacting with a second, invisible, interface. | {'id': '173', 'attrs': {'ID': '173', 'Name': 'Action Spoofing', 'Status': 'Stable', 'Abstraction': 'Meta'}} | 217901ab3c3800afe8ab7205e51f524c509fb301d0a974d33e20735698c3b0b7 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-174 | Flash Parameter Injection | Detailed | Draft | High | Medium | An adversary takes advantage of improper data validation to inject malicious global parameters into a Flash file embedded within an HTML document. Flash files can leverage user-submitted data to configure the Flash document and access the embedding HTML document. | {'id': '174', 'attrs': {'ID': '174', 'Name': 'Flash Parameter Injection', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | e3a2567afe7809c3b0ab42973e1dca6859d11d067d8b2e51b904a7d9fbb1a25c | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-175 | Code Inclusion | Meta | Stable | Medium | Very High | An adversary exploits a weakness on the target to force arbitrary code to be retrieved locally or from a remote location and executed. This differs from code injection in that code injection involves the direct inclusion of code while code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application. | {'id': '175', 'attrs': {'ID': '175', 'Name': 'Code Inclusion', 'Status': 'Stable', 'Abstraction': 'Meta'}} | 480467dbbbbbacbf18854c7938a507d5495ebadbb8e4b73129085d735bc9e5d8 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-176 | Configuration/Environment Manipulation | Meta | Draft | Medium | An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack. | {'id': '176', 'attrs': {'ID': '176', 'Name': 'Configuration/Environment Manipulation', 'Status': 'Draft', 'Abstraction': 'Meta'}} | 6666aabd57a6b2d18ad840db0db84259041fab780e84cf4c8f970c1b4caa56c9 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-186 | Malicious Software Update | Standard | Draft | High | An adversary uses deceptive methods to cause a user or an automated process to download and install dangerous code believed to be a valid update that originates from an adversary controlled source. | {'id': '186', 'attrs': {'ID': '186', 'Name': 'Malicious Software Update', 'Status': 'Draft', 'Abstraction': 'Standard'}} | ffdceb388d9672a43b45abea729d5460cb2c956a9f9c679352629584722656f8 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-431 | DEPRECATED: Target Influence via Neuro-Linguistic Programming (NLP) | Detailed | Deprecated | This attack pattern has been deprecated. | {'id': '431', 'attrs': {'ID': '431', 'Name': 'DEPRECATED: Target Influence via Neuro-Linguistic Programming (NLP)', 'Status': 'Deprecated', 'Abstraction': 'Detailed'}} | d1286423583a527f0d0a205f16ac8e9977ec74e8f4db2d45108f7d71198f5381 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |||
CAPEC-177 | Create files with the same name as files protected with a higher classification | Detailed | Draft | Very High | An attacker exploits file location algorithms in an operating system or application by creating a file with the same name as a protected or privileged file. The attacker could manipulate the system if the attacker-created file is trusted by the operating system or an application component that attempts to load the original file. Applications often load or include external files, such as libraries or configuration files. These files should be protected against malicious manipulation. However, if the application only uses the name of the file when locating it, an attacker may be able to create a file with the same name and place it in a directory that the application will search before the directory with the legitimate file is searched. Because the attackers' file is discovered first, it would be used by the target application. This attack can be extremely destructive if the referenced file is executable and/or is granted special privileges based solely on having a particular name. | {'id': '177', 'attrs': {'ID': '177', 'Name': 'Create files with the same name as files protected with a higher classification', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 5b553c1f79567ac6a67980fac6025a82551c16259cd4886bd85178ff0871c6cc | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-178 | Cross-Site Flashing | Detailed | Draft | Medium | Medium | An attacker is able to trick the victim into executing a Flash document that passes commands or calls to a Flash player browser plugin, allowing the attacker to exploit native Flash functionality in the client browser. This attack pattern occurs where an attacker can provide a crafted link to a Flash document (SWF file) which, when followed, will cause additional malicious instructions to be executed. The attacker does not need to serve or control the Flash document. The attack takes advantage of the fact that Flash files can reference external URLs. If variables that serve as URLs that the Flash application references can be controlled through parameters, then by creating a link that includes values for those parameters, an attacker can cause arbitrary content to be referenced and possibly executed by the targeted Flash application. | {'id': '178', 'attrs': {'ID': '178', 'Name': 'Cross-Site Flashing', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | b0a3805f0e6e24b52a4a787b6e3e557678f839e1ce0f6684b7ba74d0ea3ad6fd | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-179 | Calling Micro-Services Directly | Standard | Draft | Medium | An attacker is able to discover and query Micro-services at a web location and thereby expose the Micro-services to further exploitation by gathering information about their implementation and function. Micro-services in web pages allow portions of a page to connect to the server and update content without needing to cause the entire page to update. This allows user activity to change portions of the page more quickly without causing disruptions elsewhere. | {'id': '179', 'attrs': {'ID': '179', 'Name': 'Calling Micro-Services Directly', 'Status': 'Draft', 'Abstraction': 'Standard'}} | f98c8f8ec6ce4d9c503a9172ec8d9cc5e371ad6f949c56ad284a3d99a746d441 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-18 | XSS Targeting Non-Script Elements | Detailed | Draft | High | Very High | This attack is a form of Cross-Site Scripting (XSS) where malicious scripts are embedded in elements that are not expected to host scripts such as image tags (<img>), comments in XML documents (< !-CDATA->), etc. These tags may not be subject to the same input validation, output validation, and other content filtering and checking routines, so this can create an opportunity for an adversary to tunnel through the application's elements and launch a XSS attack through other elements. As with all remote attacks, it is important to differentiate the ability to launch an attack (such as probing an internal network for unpatched servers) and the ability of the remote adversary to collect and interpret the output of said attack. | {'id': '18', 'attrs': {'ID': '18', 'Name': 'XSS Targeting Non-Script Elements', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 7c8ffe106e82c16bfad54c8d0b91ddc6d7686622bd66f5ded3928e1bb2482a2b | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-180 | Exploiting Incorrectly Configured Access Control Security Levels | Standard | Draft | High | Medium | An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack. | {'id': '180', 'attrs': {'ID': '180', 'Name': 'Exploiting Incorrectly Configured Access Control Security Levels', 'Status': 'Draft', 'Abstraction': 'Standard'}} | e670d77c362d5e1eeba9fa9aab7dc67271eef7d140e63c794457dd2f75a456c7 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-181 | Flash File Overlay | Detailed | Draft | Medium | An attacker creates a transparent overlay using flash in order to intercept user actions for the purpose of performing a clickjacking attack. In this technique, the Flash file provides a transparent overlay over HTML content. Because the Flash application is on top of the content, user actions, such as clicks, are caught by the Flash application rather than the underlying HTML. The action is then interpreted by the overlay to perform the actions the attacker wishes. | {'id': '181', 'attrs': {'ID': '181', 'Name': 'Flash File Overlay', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 5f01217108a79eaa2196be8d32be41044011b3fbaaadda4981b059bf61dd6c2e | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-182 | Flash Injection | Standard | Draft | High | Medium | An attacker tricks a victim to execute malicious flash content that executes commands or makes flash calls specified by the attacker. One example of this attack is cross-site flashing, an attacker controlled parameter to a reference call loads from content specified by the attacker. | {'id': '182', 'attrs': {'ID': '182', 'Name': 'Flash Injection', 'Status': 'Draft', 'Abstraction': 'Standard'}} | ce6952a0a6bb4aa7481f3319b308658fa5ae5b79c0c015e155c2130814c967ae | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-183 | IMAP/SMTP Command Injection | Standard | Draft | Medium | An adversary exploits weaknesses in input validation on web-mail servers to execute commands on the IMAP/SMTP server. Web-mail servers often sit between the Internet and the IMAP or SMTP mail server. User requests are received by the web-mail servers which then query the back-end mail server for the requested information and return this response to the user. In an IMAP/SMTP command injection attack, mail-server commands are embedded in parts of the request sent to the web-mail server. If the web-mail server fails to adequately sanitize these requests, these commands are then sent to the back-end mail server when it is queried by the web-mail server, where the commands are then executed. This attack can be especially dangerous since administrators may assume that the back-end server is protected against direct Internet access and therefore may not secure it adequately against the execution of malicious commands. | {'id': '183', 'attrs': {'ID': '183', 'Name': 'IMAP/SMTP Command Injection', 'Status': 'Draft', 'Abstraction': 'Standard'}} | 21717b175b2ad583e0d7ddf697b190d912b3c6897b2bfbc375fefdb7e6c7b290 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-187 | Malicious Automated Software Update via Redirection | Detailed | Draft | High | High | An attacker exploits two layers of weaknesses in server or client software for automated update mechanisms to undermine the integrity of the target code-base. The first weakness involves a failure to properly authenticate a server as a source of update or patch content. This type of weakness typically results from authentication mechanisms which can be defeated, allowing a hostile server to satisfy the criteria that establish a trust relationship. The second weakness is a systemic failure to validate the identity and integrity of code downloaded from a remote location, hence the inability to distinguish malicious code from a legitimate update. | {'id': '187', 'attrs': {'ID': '187', 'Name': 'Malicious Automated Software Update via Redirection', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 84b415484720371682feb8e2b1d9dfdf6a8a6cb00ffb772dc90dbd63f565df47 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-188 | Reverse Engineering | Meta | Stable | Low | Low | An adversary discovers the structure, function, and composition of an object, resource, or system by using a variety of analysis techniques to effectively determine how the analyzed entity was constructed or operates. The goal of reverse engineering is often to duplicate the function, or a part of the function, of an object in order to duplicate or "back engineer" some aspect of its functioning. Reverse engineering techniques can be applied to mechanical objects, electronic devices, or software, although the methodology and techniques involved in each type of analysis differ widely. | {'id': '188', 'attrs': {'ID': '188', 'Name': 'Reverse Engineering', 'Status': 'Stable', 'Abstraction': 'Meta'}} | 1ae092deaeb2d6bec640c9462a49f06e6f0920cb150880170fe6f8fe65a1a8aa | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-189 | Black Box Reverse Engineering | Standard | Draft | Low | An adversary discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs. Black Box Reverse Engineering also refers to gathering physical side effects of a hardware device, such as electromagnetic radiation or sounds. | {'id': '189', 'attrs': {'ID': '189', 'Name': 'Black Box Reverse Engineering', 'Status': 'Draft', 'Abstraction': 'Standard'}} | ba0390c2b6dab168a042a158d4606c2645affe0f22e84aacde831323aa7fca9d | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-19 | Embedding Scripts within Scripts | Standard | Stable | High | High | An adversary leverages the capability to execute their own script by embedding it within other scripts that the target software is likely to execute due to programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. | {'id': '19', 'attrs': {'ID': '19', 'Name': 'Embedding Scripts within Scripts', 'Status': 'Stable', 'Abstraction': 'Standard'}} | c2fcf16d7d4c8fad444130d65b2f67fed876ac3f3df34fdca7c5a10e89dd6cb1 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | |
CAPEC-190 | Reverse Engineer an Executable to Expose Assumed Hidden Functionality | Detailed | Draft | Low | An attacker analyzes a binary file or executable for the purpose of discovering the structure, function, and possibly source-code of the file by using a variety of analysis techniques to effectively determine how the software functions and operates. This type of analysis is also referred to as Reverse Code Engineering, as techniques exist for extracting source code from an executable. Several techniques are often employed for this purpose, both black box and white box. The use of computer bus analyzers and packet sniffers allows the binary to be studied at a level of interactions with its computing environment, such as a host OS, inter-process communication, and/or network communication. This type of analysis falls into the 'black box' category because it involves behavioral analysis of the software without reference to source code, object code, or protocol specifications. | {'id': '190', 'attrs': {'ID': '190', 'Name': 'Reverse Engineer an Executable to Expose Assumed Hidden Functionality', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | f718742ce288be3cadedd757db537a2b858f339b180e44d8756d9aca25cc6ca4 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 | ||
CAPEC-191 | Read Sensitive Constants Within an Executable | Detailed | Draft | Low | {'id': '191', 'attrs': {'ID': '191', 'Name': 'Read Sensitive Constants Within an Executable', 'Status': 'Draft', 'Abstraction': 'Detailed'}} | 114765546a04eb9376ed46966baa3c8d4a848c9d869032efa0391e245a614b26 | 2026-06-01 17:16:13.996373+03:00 | 2026-06-01 17:16:13.996373+03:00 |