CAPEC-116: Excavation

Excavation

状态:Stable

Typical_Severify: Medium

攻击可能性:High

描述

An adversary actively probes the target in a manner that is designed to solicit information that could be leveraged for malicious purposes. This is achieved by exploring the target via ordinary interactions for the purpose of gathering intelligence about the target, or by sending data that is syntactically invalid or non-standard in an attempt to produce a response that contains the desired data. As a result of these interactions, the adversary is able to obtain information from the target that aids the attacker in making inferences about its security, configuration, or potential vulnerabilities. Examplar exchanges with the target may trigger unhandled exceptions or verbose error messages that reveal information like stack traces, configuration information, path information, or database design. This type of attack also includes the manipulation of query strings in a URI to produce invalid SQL queries, or by trying alternative path values in the hope that the server will return useful information.

相关攻击模式

ParentOf: CAPEC-150 | Collect Data from Common Resource Locations

ParentOf: CAPEC-163 | Spear Phishing

ParentOf: CAPEC-54 | Query System for Information

ParentOf: CAPEC-545 | Pull Data from System Resources

ParentOf: CAPEC-569 | Collect Data as Provided by Users

前置条件

An adversary requires some way of interacting with the system.

所需资源

A tool, such as a MITM Proxy or a fuzzer, that is capable of generating and injecting custom inputs to be used in the attack.

后果

Scope Impact Likelihood
C o n f i d e n t i a l i t y Read Data

缓解措施

Minimize error/response output to only what is necessary for functional use or corrective language.

Remove potentially sensitive information that is not necessary for the application's functionality.

实例

相关CWE

200 | 信息暴露

内容历史记录

提交

2014-06-23 | CAPEC Content Team | The MITRE Corporation

修改

2015-11-09 | CAPEC Content Team | The MITRE Corporation

Updated Activation_Zone, Attack_Prerequisites, Description Summary, Injection_Vector, Payload, Payload_Activation_Impact

2017-05-01 | CAPEC Content Team | The MITRE Corporation

Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Other_Notes, Related_Weaknesses, Resources_Required, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit