COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATION (CAPEC)

The objective of the Common Attack Pattern Enumeration and Classification (CAPEC) effort is to provide a publicly available catalog of common attack patterns classified in an intuitive manner, along with a comprehensive schema for describing related attacks and sharing information about them.

Common searches: SQL injection Cross-Site Scripting Cross Site Request Forgery Session Hijacking Configuration Cellular Mobile Clickjacking Path Traversal XML Libraries 

= 514 items (filtered by ) /
  • Engage in Deceptive Interactions
    Attack patterns within this category focus on malicious interactions with a target in an attempt to deceive the target and convince the target that it is interacting with some other principal and as such take actions based on the level of trust that exists between the target and the other principal.
    • Content Spoofing
      An adversary modifies content to make it contain something other than what the original content producer intended while keeping the apparent source of the content unchanged.
      • Intent Spoof
        An adversary, through a previously installed malicious application, issues an intent directed toward a specific trusted application's component in an attempt to achieve a variety of different objectives including modification of data, information disclosure, and data injection.
        • Counterfeit GPS Signals
          An adversary attempts to deceive a GPS receiver by broadcasting counterfeit GPS signals, structured to resemble a set of normal GPS signals.
          • Carry-Off GPS Attack
            A common form of a GPS spoofing attack, commonly termed a carry-off attack begins with an adversary broadcasting signals synchronized with the genuine signals observed by the target receiver.
            • Spoofing of UDDI/ebXML Messages
              An attacker spoofs a UDDI, ebXML, or similar message in order to impersonate a service provider in an e-business transaction.
              • Checksum Spoofing
                An adversary spoofs a checksum message for the purpose of making a payload appear to have a valid corresponding checksum.
                • Identity Spoofing
                  Identity Spoofing refers to the action of assuming (i.
                  • Signature Spoof
                    An attacker generates a message or datablock that causes the recipient to believe that the message or datablock was generated and cryptographically signed by an authoritative or reputable source, misleading a victim or victim operating system into performing malicious actions.
                    • Signature Spoofing by Key Theft
                      An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
                      • Signature Spoofing by Misrepresentation
                        An attacker exploits a weakness in the parsing or display code of the recipient software to generate a data blob containing a supposedly valid signature, but the signer's identity is falsely represented, which can lead to the attacker manipulating the recipient software or its victim user to perform compromising actions.
                        • Signature Spoofing by Key Recreation
                          An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
                          • Pharming
                            A pharming attack occurs when the victim is fooled into entering sensitive data into supposedly trusted locations, such as an online bank site or a trading platform.
                            • Fake the Source of Data
                              An adversary provides data under a falsified identity.
                              • Counterfeit Organizations
                                An adversary creates a false front organizations with the appearance of a legitimate supplier in the critical life cycle path that then injects corrupted/malicious information system components into the organizational supply chain.
                                • DNS Spoofing
                                  An adversary sends a malicious ("NXDOMAIN" ("No such domain") code, or DNS A record) response to a targets route request before a legitimate resolver can.
                                  • Principal Spoof
                                    A Principle Spoof is a form of Identity Spoofing where an adversary pretends to be some other person in an interaction.
                                    • Terrestrial Jamming
                                      In this attack pattern, the adversary transmits disruptive signals in the direction of the target consumer-level satellite dish (as opposed to the satellite itself).
                                      • Phishing
                                        Phishing is a social engineering technique where an attacker masquerades as a legitimate entity with which the victim might do business in order to prompt the user to reveal some confidential information (very frequently authentication credentials) that can later be used by an attacker.
                                        • Spear Phishing
                                          An adversary targets a specific user or group with a Phishing (CAPEC-98) attack tailored to a category of users in order to have maximum relevance and deceptive capability.
                                          • Mobile Phishing
                                            An attacker targets mobile phone users with a phishing attack for the purpose of soliciting account passwords or sensitive information from the user.
                                            • Resource Location Spoofing
                                              An adversary deceives an application or user and convinces them to request a resource from an unintended location.
                                              • Establish Rogue Location
                                                An adversary provides a malicious version of a resource at a location that is similar to the expected location of a legitimate resource.
                                                • BitSquatting
                                                  An adversary registers a domain name one bit different than a trusted domain.
                                                  • Evil Twin Wi-Fi Attack
                                                    Adversaries install Wi-Fi equipment that acts as a legitimate Wi-Fi network access point.
                                                    • Cellular Rogue Base Station
                                                      In this attack scenario, the attacker imitates a cellular base station with his own “rogue” base station equipment.
                                                      • TypoSquatting
                                                        An adversary registers a domain name with at least one character different than a trusted domain.
                                                        • SoundSquatting
                                                          An adversary registers a domain name that sounds the same as a trusted domain, but has a different spelling.
                                                          • Homograph Attack via Homoglyphs
                                                            An adversary registers a domain name containing a homoglyph, leading the registered domain to appear the same as a trusted domain.
                                                            • Redirect Access to Libraries
                                                              An attacker exploits the execution flow of a call to an external library to point to an attacker supplied library or code base, allowing the attacker to compromise the application or server via the execution of unauthorized code.
                                                              • DLL Search Order Hijacking
                                                                The attacker exploits the functionality of the Windows DLL loader where the process loading the DLL searches for the DLL to be loaded first in the same directory in which the process binary resides and then in other directories (e.
                                                                • Symlink Attack
                                                                  An attacker positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
                                                                  • Action Spoofing
                                                                    An adversary is able to disguise one action for another and therefore trick a user into initiating one type of action when they intend to initiate a different action.
                                                                    • Task Impersonation
                                                                      An adversary, through a previously installed malicious application, monitors the task list maintained by the operating system and waits for a specific legitimate task to become active.
                                                                      • Scheme Squatting
                                                                        An adversary, through a previously installed malicious application, registers for a URL scheme intended for a target application that has not been installed.
                                                                        • Tapjacking
                                                                          An adversary, through a previously installed malicious application, displays an interface that misleads the user and convinces him/her to tap in an attacker desired location on the screen.
                                                                          • Clickjacking
                                                                            In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from a seemingly completely different system.
                                                                            • iFrame Overlay
                                                                              In an iFrame overlay attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from seemingly completely different system.
                                                                              • Flash File Overlay
                                                                                An attacker creates a transparent overlay using flash in order to intercept user actions for the purpose of performing a clickjacking attack.
                                                                                • Abuse Existing Functionality
                                                                                  An adversary uses or manipulates one or more functions of an application in order to achieve a malicious objective not originally intended by the application, or to deplete a resource to the point that the target's functionality is affected.
                                                                                  • API Manipulation
                                                                                    An adversary manipulates the use or processing of an Application Programming Interface (API) resulting in an adverse impact upon the security of the system implementing the API.
                                                                                    • Exploit Test APIs
                                                                                      An attacker exploits a sample, demonstration, or test API that is insecure by default and should not be resident on production systems.
                                                                                      • Try All Common Switches
                                                                                        An attacker attempts to invoke all common switches and options in the target application for the purpose of discovering weaknesses in the target.
                                                                                        • Using Unpublished APIs
                                                                                          An adversary searches for and invokes APIs that the target system designers did not intend to be publicly available.
                                                                                          • Flooding
                                                                                            An adversary consumes the resources of a target by rapidly engaging in a large number of interactions with the target.
                                                                                            • XML Flood
                                                                                              An adversary may execute a flooding attack using XML messages with the intent to deny legitimate users access to a web service.
                                                                                              • XML Ping of the Death
                                                                                                An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target.
                                                                                                • TCP Flood
                                                                                                  An adversary may execute a flooding attack using the TCP protocol with the intent to deny legitimate users access to a service.
                                                                                                  • UDP Flood
                                                                                                    An adversary may execute a flooding attack using the UDP protocol with the intent to deny legitimate users access to a service by consuming the available network bandwidth.
                                                                                                    • ICMP Flood
                                                                                                      An adversary may execute a flooding attack using the ICMP protocol with the intent to deny legitimate users access to a service by consuming the available network bandwidth.
                                                                                                      • HTTP Flood
                                                                                                        An adversary may execute a flooding attack using the HTTP protocol with the intent to deny legitimate users access to a service by consuming resources at the application layer such as web services and their infrastructure.
                                                                                                        • SSL Flood
                                                                                                          An adversary may execute a flooding attack using the SSL protocol with the intent to deny legitimate users access to a service by consuming all the available resources on the server side.
                                                                                                          • Amplification
                                                                                                            An adversary may execute an amplification where the size of a response is far greater than that of the request that generates it.
                                                                                                            • Excessive Allocation
                                                                                                              An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services.
                                                                                                              • XML Nested Payloads
                                                                                                                Applications often need to transform data in and out of the XML format by using an XML parser.
                                                                                                                • XML Quadratic Expansion
                                                                                                                  An adversary exploits a few properties of XML(substitution entities and inline DTDs) to cause a denial of service situation due to excessive memory being allocated to fully expand the XML.
                                                                                                                  • XML Entity Expansion
                                                                                                                    An attacker submits an XML document to a target application where the XML document uses nested entity expansion to produce an excessively large output XML.
                                                                                                                    • XML Oversized Payloads
                                                                                                                      Applications often need to transform data in and out of the XML format by using an XML parser.
                                                                                                                      • XML Entity Blowup
                                                                                                                        An attacker creates an XML document that with an external entity reference.
                                                                                                                        • XML Attribute Blowup
                                                                                                                          This attack exploits certain XML parsers which manage data in an inefficient manner.
                                                                                                                          • Regular Expression Exponential Blowup
                                                                                                                            An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex.
                                                                                                                            • SOAP Array Blowup
                                                                                                                              An adversary may execute an attack on a web service that uses SOAP messages in communication.
                                                                                                                              • TCP Fragmentation
                                                                                                                                An attacker may execute a TCP Fragmentation attack against a target with the intention of avoiding filtering rules.
                                                                                                                                • UDP Fragmentation
                                                                                                                                  An attacker may execute a UDP Fragmentation attack against a target server in an attempt to consume resources such as bandwidth and CPU.
                                                                                                                                  • ICMP Fragmentation
                                                                                                                                    An attacker may execute a ICMP Fragmentation attack against a target with the intention of consuming resources or causing a crash.
                                                                                                                                    • Resource Leak Exposure
                                                                                                                                      An adversary utilizes a resource leak on the target to deplete the quantity of the resource available to service legitimate requests.
                                                                                                                                      • Functionality Misuse
                                                                                                                                        An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact.
                                                                                                                                        • Inducing Account Lockout
                                                                                                                                          An attacker leverages the security functionality of the system aimed at thwarting potential attacks to launch a denial of service attack against a legitimate system user.
                                                                                                                                          • Drop Encryption Level
                                                                                                                                            An attacker forces the encryption level to be lowered, thus enabling a successful attack against the encrypted data.
                                                                                                                                            • Weakening of Cellular Encryption
                                                                                                                                              An attacker, with control of a Cellular Rogue Base Station or through cooperation with a Malicious Mobile Network Operator can force the mobile device (e.
                                                                                                                                              • Password Recovery Exploitation
                                                                                                                                                An attacker may take advantage of the application feature to help users recover their forgotten passwords in order to gain access into the system with the same privileges as the original user.
                                                                                                                                                • Communication Channel Manipulation
                                                                                                                                                  An adversary manipulates a setting or parameter on communications channel in order to compromise its security.
                                                                                                                                                  • Choosing Message Identifier
                                                                                                                                                    This pattern of attack is defined by the selection of messages distributed over via multicast or public information channels that are intended for another client by determining the parameter value assigned to that client.
                                                                                                                                                    • Sustained Client Engagement
                                                                                                                                                      An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible.
                                                                                                                                                      • HTTP DoS
                                                                                                                                                        An attacker performs flooding at the HTTP level to bring down only a particular web application rather than anything listening on a TCP/IP connection.
                                                                                                                                                        • Protocol Manipulation
                                                                                                                                                          An adversary subverts a communications protocol to perform an attack.
                                                                                                                                                          • Client-Server Protocol Manipulation
                                                                                                                                                            An adversary takes advantage of weaknesses in the protocol by which a client and server are communicating to perform unexpected actions.
                                                                                                                                                            • Blue Boxing
                                                                                                                                                              This type of attack against older telephone switches and trunks has been around for decades.
                                                                                                                                                              • HTTP Request Splitting
                                                                                                                                                                HTTP Request Splitting (also known as HTTP Request Smuggling) is an attack pattern where an attacker attempts to insert additional HTTP requests in the body of the original (enveloping) HTTP request in such a way that the browser interprets it as one request but the web server interprets it as two.
                                                                                                                                                                • HTTP Request Smuggling
                                                                                                                                                                  HTTP Request Smuggling results from the discrepancies in parsing HTTP requests between HTTP entities such as web caching proxies or application firewalls.
                                                                                                                                                                  • HTTP Response Splitting
                                                                                                                                                                    This attack uses a maliciously-crafted HTTP request in order to cause a vulnerable web server to respond with an HTTP response stream that will be interpreted by the client as two separate responses instead of one.
                                                                                                                                                                    • HTTP Response Smuggling
                                                                                                                                                                      An attacker injects content into a server response that is interpreted differently by intermediaries than it is by the target browser.
                                                                                                                                                                      • DNS Rebinding
                                                                                                                                                                        An adversary serves content whose IP address is resolved by a DNS server that the adversary controls.
                                                                                                                                                                        • Web Services Protocol Manipulation
                                                                                                                                                                          An attacker manipulates functions and/or their values used by web-related protocols to cause a web application or service to react differently that intended, allowing the attacker to gain access to data or resources normally restricted or to cause the application or service to crash.
                                                                                                                                                                          • Functionality Bypass
                                                                                                                                                                            An adversary attacks a system by bypassing some or all functionality intended to protect it.
                                                                                                                                                                            • Evercookie
                                                                                                                                                                              An attacker creates a very persistent cookie that stays present even after the user thinks it has been removed.
                                                                                                                                                                              • Transparent Proxy Abuse
                                                                                                                                                                                A transparent proxy serves as an intermediate between the client and the internet at large.
                                                                                                                                                                                • Calling Micro-Services Directly
                                                                                                                                                                                  An attacker is able to discover and query Micro-services at a web location and thereby expose the Micro-services to further exploitation by gathering information about their implementation and function.
                                                                                                                                                                                  • Manipulate System Resources
                                                                                                                                                                                    This category is related to the WASC Threat Classification 2.
                                                                                                                                                                                    • Software Integrity Attack
                                                                                                                                                                                      An attacker initiates a series of events designed to cause a user, program, server, or device to perform actions which undermine the integrity of software code, device data structures, or device firmware, achieving the modification of the target's integrity to achieve an insecure state.
                                                                                                                                                                                      • Malicious Software Download
                                                                                                                                                                                        An attacker uses deceptive methods to cause a user or an automated process to download and install dangerous code that originates from an attacker controlled source.
                                                                                                                                                                                        • Malicious Software Update
                                                                                                                                                                                          An attacker uses deceptive methods to cause a user or an automated process to download and install dangerous code believed to be a valid update that originates from an attacker controlled source.
                                                                                                                                                                                          • Rooting SIM Cards
                                                                                                                                                                                            SIM cards are the de facto trust anchor of mobile devices worldwide.
                                                                                                                                                                                            • Malicious Manual Software Update
                                                                                                                                                                                              An attacker introduces malicious code to the victim's system by altering the payload of a software update, allowing for additional compromise or site disruption at the victim location.
                                                                                                                                                                                              • Malicious Automated Software Update
                                                                                                                                                                                                An attacker exploits a weakness in a server or client's process of delivering and verifying the integrity of code supplied by an update-providing server or mechanism to cause code of the attackers' choosing to be downloaded and installed as a software update.
                                                                                                                                                                                                • Hardware Integrity Attack
                                                                                                                                                                                                  An attacker changes a technology, product, component, or sub-component during its deployed use at the victim location for the purpose of carrying out an attack.
                                                                                                                                                                                                  • Hacking Hardware
                                                                                                                                                                                                    An attacker changes or replaces a hardware component which undermines the system's integrity for the purpose of carrying out an attack.
                                                                                                                                                                                                    • Bypassing ATA Password Security
                                                                                                                                                                                                      An attacker exploits a weakness in ATA security on a drive to gain access to the information the drive contains without supplying the proper credentials.
                                                                                                                                                                                                      • Malicious Hardware Update
                                                                                                                                                                                                        An attacker introduces malicious hardware during an update or replacement procedure, allowing for additional compromise or site disruption at the victim location.
                                                                                                                                                                                                        • Hardware Component Substitution
                                                                                                                                                                                                          An attacker substitutes out a tested and approved hardware component for a maliciously-altered hardware component.
                                                                                                                                                                                                          • Provide Counterfeit Component
                                                                                                                                                                                                            An attacker provides a counterfeit component during the procurement process of a lower-tier component supplier to a sub-system developer or integrator, which is then built into the system being upgraded or repaired by the victim, allowing the attacker to cause disruption or additional compromise.
                                                                                                                                                                                                            • Malicious Gray Market Hardware
                                                                                                                                                                                                              An attacker maliciously alters hardware components that will be sold on the gray market, allowing for victim disruption and compromise when the victim needs replacement hardware components for systems where the parts are no longer in regular supply from original suppliers, or where the hardware components from the attacker seems to be a great benefit from a cost perspective.
                                                                                                                                                                                                              • Infrastructure Manipulation
                                                                                                                                                                                                                An attacker exploits characteristics of the infrastructure of a network entity in order to perpetrate attacks or information gathering on network objects or effect a change in the ordinary information flow between network objects.
                                                                                                                                                                                                                • Cache Poisoning
                                                                                                                                                                                                                  An attacker exploits the functionality of cache technologies to cause specific data to be cached that aids the attackers' objectives.
                                                                                                                                                                                                                  • Audit Log Manipulation
                                                                                                                                                                                                                    The attacker injects, manipulates, deletes, or forges malicious log entries into the log file, in an attempt to mislead an audit of the log file or cover tracks of an attack.
                                                                                                                                                                                                                    • Web Logs Tampering
                                                                                                                                                                                                                      Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior.
                                                                                                                                                                                                                      • Force the System to Reset Values
                                                                                                                                                                                                                        An attacker forces the target into a previous state in order to leverage potential weaknesses in the target dependent upon a prior configuration or state-dependent factors.
                                                                                                                                                                                                                        • File Manipulation
                                                                                                                                                                                                                          An attacker modifies file contents or attributes (such as extensions or names) of files in a manner to cause incorrect processing by an application.
                                                                                                                                                                                                                          • Leverage Executable Code in Non-Executable Files
                                                                                                                                                                                                                            An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.
                                                                                                                                                                                                                            • User-Controlled Filename
                                                                                                                                                                                                                              An attack of this type involves an adversary inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content.
                                                                                                                                                                                                                              • Configuration/Environment Manipulation
                                                                                                                                                                                                                                An attacker manipulates files or settings external to a target application which affect the behavior of that application.
                                                                                                                                                                                                                                • Data Injected During Configuration
                                                                                                                                                                                                                                  An attacker with access to data files and processes on a victim's system injects false data into critical operational data during configuration or recalibration, causing the victim's system to perform in a suboptimal manner that benefits the attacker.
                                                                                                                                                                                                                                  • Schema Poisoning
                                                                                                                                                                                                                                    An attacker corrupts or modifies the content of a schema for the purpose of undermining the security of the target.
                                                                                                                                                                                                                                    • XML Schema Poisoning
                                                                                                                                                                                                                                      An attacker corrupts or modifies the content of XML schema information passed between a client and server for the purpose of undermining the security of the target.
                                                                                                                                                                                                                                      • Manipulating Writeable Configuration Files
                                                                                                                                                                                                                                        Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.
                                                                                                                                                                                                                                        • Obstruction
                                                                                                                                                                                                                                          An attacker obstructs the interactions between system components.
                                                                                                                                                                                                                                          • Jamming
                                                                                                                                                                                                                                            An adversary uses radio noise or signals in an attempt to disrupt communications.
                                                                                                                                                                                                                                            • Wi-Fi Jamming
                                                                                                                                                                                                                                              In this attack scenario, the attacker actively transmits on the Wi-Fi channel to prevent users from transmitting or receiving data from the targeted Wi-Fi network.
                                                                                                                                                                                                                                              • Cellular Jamming
                                                                                                                                                                                                                                                In this attack scenario, the attacker actively transmits signals to overpower and disrupt the communication between a cellular user device and a cell tower.
                                                                                                                                                                                                                                                • Orbital Jamming
                                                                                                                                                                                                                                                  In this attack pattern, the adversary sends disruptive signals at a target satellite using a rogue uplink station to disrupt the intended transmission.
                                                                                                                                                                                                                                                  • Blockage
                                                                                                                                                                                                                                                    An adversary blocks the delivery of an important system resource causing the system to fail or stop working.
                                                                                                                                                                                                                                                    • DNS Blocking
                                                                                                                                                                                                                                                      An adversary intercepts traffic and intentionally drops DNS requests based on content in the request.
                                                                                                                                                                                                                                                      • IP Address Blocking
                                                                                                                                                                                                                                                        An adversary performing this type of attack drops packets destined for a target IP address.
                                                                                                                                                                                                                                                        • Block Access to Libraries
                                                                                                                                                                                                                                                          An application typically makes calls to functions that are a part of libraries external to the application.
                                                                                                                                                                                                                                                          • Route Disabling
                                                                                                                                                                                                                                                            An adversary disables the network route between two targets.
                                                                                                                                                                                                                                                            • Disabling Network Hardware
                                                                                                                                                                                                                                                              In this attack pattern, an adversary physically disables networking hardware by powering it down or disconnecting critical equipment.
                                                                                                                                                                                                                                                              • BGP Route Disabling
                                                                                                                                                                                                                                                                An adversary suppresses the Border Gateway Protocol (BGP) advertisement for a route so as to render the underlying network inaccessible.
                                                                                                                                                                                                                                                                • DNS Domain Seizure
                                                                                                                                                                                                                                                                  In this attack pattern, an adversary influences a target's web-hosting company to disables a target domain.
                                                                                                                                                                                                                                                                  • Modification During Manufacture
                                                                                                                                                                                                                                                                    An attacker modifies a technology, product, or component during a stage in its manufacture for the purpose of carrying out an attack against some entity involved in the supply chain lifecycle.
                                                                                                                                                                                                                                                                    • Design Alteration
                                                                                                                                                                                                                                                                      An attacker modifies the design of a technology, product, or component.
                                                                                                                                                                                                                                                                      • Documentation Alteration to Circumvent Dial-down
                                                                                                                                                                                                                                                                        An attacker with access to a manufacturer's documentation, which include descriptions of advanced technology and/or specific components' criticality, alters the documents to circumvent dial-down functionality requirements.
                                                                                                                                                                                                                                                                        • Documentation Alteration to Produce Under-performing Systems
                                                                                                                                                                                                                                                                          An attacker with access to a manufacturer's documentation alters the descriptions of system capabilities with the intent of causing errors in derived system requirements, impacting the overall effectiveness and capability of the system, allowing an attacker to take advantage of the introduced system capability flaw once the system is deployed.
                                                                                                                                                                                                                                                                          • Hardware Design Specifications Are Altered
                                                                                                                                                                                                                                                                            An attacker with access to a manufacturer's hardware manufacturing process documentation alters the design specifications, which introduces flaws advantageous to the attacker once the system is deployed.
                                                                                                                                                                                                                                                                            • Manipulation During Distribution
                                                                                                                                                                                                                                                                              An attacker undermines the integrity of a product, software, or technology at some stage of the distribution channel.
                                                                                                                                                                                                                                                                              • Malicious Hardware Component Replacement
                                                                                                                                                                                                                                                                                An attacker replaces legitimate hardware in the system with faulty counterfeit or tampered hardware in the supply chain distribution channel, with purpose of causing malicious disruption or allowing for additional compromise when the system is deployed.
                                                                                                                                                                                                                                                                                • Malicious Software Implanted
                                                                                                                                                                                                                                                                                  An attacker implants malicious software into the system in the supply chain distribution channel, with purpose of causing malicious disruption or allowing for additional compromise when the system is deployed.
                                                                                                                                                                                                                                                                                  • Rogue Integration Procedures
                                                                                                                                                                                                                                                                                    An attacker alters or establishes rogue processes in an integration facility in order to insert maliciously altered components into the system.
                                                                                                                                                                                                                                                                                    • Malicious Logic Insertion
                                                                                                                                                                                                                                                                                      An attacker installs or adds malicious logic into a seemingly benign component of the system.
                                                                                                                                                                                                                                                                                      • Malicious Logic Inserted Into To Product Software
                                                                                                                                                                                                                                                                                        An attacker inserts malicious logic into software, typically in the form of a traditional virus or trojan backdoor.
                                                                                                                                                                                                                                                                                        • Altered Installed BIOS
                                                                                                                                                                                                                                                                                          An attacker with access to download and update system software sends a maliciously altered BIOS to the victim or victim supplier/integrator, which when installed allows for future exploitation.
                                                                                                                                                                                                                                                                                          • Open Source Libraries Altered
                                                                                                                                                                                                                                                                                            An attacker with access to an open source code project and knowledge of its particular use for in a system being developed, manufactured, or supported for the victim, can insert malicious code into the open source software used for math libraries in anticipation of inclusion into the system for the purpose of disruption or further compromise within the victim organization.
                                                                                                                                                                                                                                                                                            • Malware Infection into Product Software
                                                                                                                                                                                                                                                                                              An attacker tampers with the code of a product and injects malicious logic into the device in order to infect any machine which interfaces with the product, and possibly steal private data or eavesdrop.
                                                                                                                                                                                                                                                                                              • Malicious Logic Insertion into Product Memory
                                                                                                                                                                                                                                                                                                An attacker inserts malicious logic into memory enabling them to achieve a negative impact.
                                                                                                                                                                                                                                                                                                • USB Memory Attacks
                                                                                                                                                                                                                                                                                                  An attacker loads malicious code onto a USB memory stick in order to infect any system which the device is plugged in to.
                                                                                                                                                                                                                                                                                                  • Flash Memory Attacks
                                                                                                                                                                                                                                                                                                    An attacker inserts malicious logic into a product or technology via flashing the on-board memory with a code-base that contains malicious logic.
                                                                                                                                                                                                                                                                                                    • Contaminate Resource
                                                                                                                                                                                                                                                                                                      An adversary contaminates organizational information systems (including devices and networks) by causing them to handle information of a classification/sensitivity for which they have not been authorized.
                                                                                                                                                                                                                                                                                                      • Inject Unexpected Items
                                                                                                                                                                                                                                                                                                        Attack patterns within this category focus on the ability to control or disrupt the behavior of an target either through crafted data submitted via an interface for data input, or the installation and execution of malicious code on the target system.
                                                                                                                                                                                                                                                                                                        • Parameter Injection
                                                                                                                                                                                                                                                                                                          An adversary exploits weaknesses in input validation by manipulating the content of request parameters for the purpose of undermining the security of the target.
                                                                                                                                                                                                                                                                                                          • Argument Injection
                                                                                                                                                                                                                                                                                                            An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.
                                                                                                                                                                                                                                                                                                            • Command Delimiters
                                                                                                                                                                                                                                                                                                              An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database.
                                                                                                                                                                                                                                                                                                              • Email Injection
                                                                                                                                                                                                                                                                                                                An attacker manipulates the headers and content of an email message by injecting data via the use of delimiter characters native to the protocol.
                                                                                                                                                                                                                                                                                                                • Format String Injection
                                                                                                                                                                                                                                                                                                                  An adversary includes formatting characters in a string input field on the target application.
                                                                                                                                                                                                                                                                                                                  • Reflection Injection
                                                                                                                                                                                                                                                                                                                    An adversary supplies a value to the target application which is then used by reflection methods to identify a class, method, or field.
                                                                                                                                                                                                                                                                                                                    • Flash Injection
                                                                                                                                                                                                                                                                                                                      An attacker tricks a victim to execute malicious flash content that executes commands or makes flash calls specified by the attacker.
                                                                                                                                                                                                                                                                                                                      • Cross-Site Flashing
                                                                                                                                                                                                                                                                                                                        An attacker is able to trick the victim into executing a Flash document that passes commands or calls to a Flash player browser plugin, allowing the attacker to exploit native Flash functionality in the client browser.
                                                                                                                                                                                                                                                                                                                        • Code Inclusion
                                                                                                                                                                                                                                                                                                                          An adversary exploits a weakness on the target to force arbitrary code to be retrieved locally or from a remote location and executed.
                                                                                                                                                                                                                                                                                                                          • Remote Code Inclusion
                                                                                                                                                                                                                                                                                                                            The attacker forces an application to load arbitrary code files from a remote location.
                                                                                                                                                                                                                                                                                                                            • WebView Injection
                                                                                                                                                                                                                                                                                                                              An adversary, through a previously installed malicious application, injects code into the context of a web page displayed by a WebView component.
                                                                                                                                                                                                                                                                                                                              • PHP Remote File Inclusion
                                                                                                                                                                                                                                                                                                                                In this pattern the adversary is able to load and execute arbitrary code remotely available from the application.
                                                                                                                                                                                                                                                                                                                                • Resource Injection
                                                                                                                                                                                                                                                                                                                                  An adversary exploits weaknesses in input validation by manipulating resource identifiers enabling the unintended modification or specification of a resource.
                                                                                                                                                                                                                                                                                                                                  • Cellular Data Injection
                                                                                                                                                                                                                                                                                                                                    Adversaries inject data into mobile technology traffic (data flows or signaling data) to disrupt communications or conduct additional surveillance operations.
                                                                                                                                                                                                                                                                                                                                    • Code Injection
                                                                                                                                                                                                                                                                                                                                      An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing.
                                                                                                                                                                                                                                                                                                                                      • File Content Injection
                                                                                                                                                                                                                                                                                                                                        An attack of this type exploits the host's trust in executing remote content, including binary files.
                                                                                                                                                                                                                                                                                                                                        • Cross-Site Scripting (XSS)
                                                                                                                                                                                                                                                                                                                                          An adversary embeds malicious scripts in content that will be served to web browsers.
                                                                                                                                                                                                                                                                                                                                          • DOM-Based XSS
                                                                                                                                                                                                                                                                                                                                            This type of attack is a form of Cross-Site Scripting (XSS) where a malicious script is inserted into the client-side HTML being parsed by a web browser.
                                                                                                                                                                                                                                                                                                                                            • Reflected XSS
                                                                                                                                                                                                                                                                                                                                              This type of attack is a form of Cross-Site Scripting (XSS) where a malicious script is “reflected” off a vulnerable web application and then executed by a victim's browser.
                                                                                                                                                                                                                                                                                                                                              • XSS Targeting Non-Script Elements
                                                                                                                                                                                                                                                                                                                                                This attack is a form of Cross-Site Scripting (XSS) where malicious scripts are embedded in elements that are not expected to host scripts such as image tags (), comments in XML documents (), etc.
                                                                                                                                                                                                                                                                                                                                                • XSS Targeting URI Placeholders
                                                                                                                                                                                                                                                                                                                                                  An attack of this type exploits the ability of most browsers to interpret "data", "javascript" or other URI schemes as client-side executable content placeholders.
                                                                                                                                                                                                                                                                                                                                                  • XSS Using Doubled Characters
                                                                                                                                                                                                                                                                                                                                                    The attacker bypasses input validation by using doubled characters in order to perform a cross-site scripting attack.
                                                                                                                                                                                                                                                                                                                                                    • XSS Through HTTP Query Strings
                                                                                                                                                                                                                                                                                                                                                      An adversary embeds malicious script code in the parameters of an HTTP query string and convinces a victim to submit the HTTP request that contains the query string to a vulnerable web application.
                                                                                                                                                                                                                                                                                                                                                      • XSS Through HTTP Headers
                                                                                                                                                                                                                                                                                                                                                        An adversary exploits web applications that generate web content, such as links in a HTML page, based on unvalidated or improperly validated data submitted by other actors.
                                                                                                                                                                                                                                                                                                                                                        • XSS Targeting Error Pages
                                                                                                                                                                                                                                                                                                                                                          An adversary distributes a link (or possibly some other query structure) with a request to a third party web server that is malformed and also contains a block of exploit code in order to have the exploit become live code in the resulting error page.
                                                                                                                                                                                                                                                                                                                                                          • XSS Using Alternate Syntax
                                                                                                                                                                                                                                                                                                                                                            An adversary uses alternate forms of keywords or commands that result in the same action as the primary form but which may not be caught by filters.
                                                                                                                                                                                                                                                                                                                                                            • Stored XSS
                                                                                                                                                                                                                                                                                                                                                              This type of attack is a form of Cross-site Scripting (XSS) where a malicious script is persistenly “stored” within the data storage of a vulnerable web application.
                                                                                                                                                                                                                                                                                                                                                              • XSS Using MIME Type Mismatch
                                                                                                                                                                                                                                                                                                                                                                An adversary creates a file with scripting content but where the specified MIME type of the file is such that scripting is not expected.
                                                                                                                                                                                                                                                                                                                                                                • Command Injection
                                                                                                                                                                                                                                                                                                                                                                  An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended.
                                                                                                                                                                                                                                                                                                                                                                  • XML Injection
                                                                                                                                                                                                                                                                                                                                                                    An attacker utilizes crafted XML user-controllable input to probe, attack, and inject data into the XML database, using techniques similar to SQL injection.
                                                                                                                                                                                                                                                                                                                                                                    • DTD Injection
                                                                                                                                                                                                                                                                                                                                                                      An attacker injects malicious content into an application's DTD in an attempt to produce a negative technical impact.
                                                                                                                                                                                                                                                                                                                                                                      • XPath Injection
                                                                                                                                                                                                                                                                                                                                                                        An attacker can craft special user-controllable input consisting of XPath expressions to inject the XML database and bypass authentication or glean information that he normally would not be able to.
                                                                                                                                                                                                                                                                                                                                                                        • XQuery Injection
                                                                                                                                                                                                                                                                                                                                                                          This attack utilizes XQuery to probe and attack server systems; in a similar manner that SQL Injection allows an attacker to exploit SQL calls to RDBMS, XQuery Injection uses improperly validated data that is passed to XQuery commands to traverse and execute commands that the XQuery routines have access to.
                                                                                                                                                                                                                                                                                                                                                                          • LDAP Injection
                                                                                                                                                                                                                                                                                                                                                                            An attacker manipulates or crafts an LDAP query for the purpose of undermining the security of the target.
                                                                                                                                                                                                                                                                                                                                                                            • SQL Injection
                                                                                                                                                                                                                                                                                                                                                                              This attack exploits target software that constructs SQL statements based on user input.
                                                                                                                                                                                                                                                                                                                                                                              • Blind SQL Injection
                                                                                                                                                                                                                                                                                                                                                                                Blind SQL Injection results from an insufficient mitigation for SQL Injection.
                                                                                                                                                                                                                                                                                                                                                                                • Object Relational Mapping Injection
                                                                                                                                                                                                                                                                                                                                                                                  An attacker leverages a weakness present in the database access layer code generated with an Object Relational Mapping (ORM) tool or a weakness in the way that a developer used a persistence framework to inject his or her own SQL commands to be executed against the underlying database.
                                                                                                                                                                                                                                                                                                                                                                                  • Expanding Control over the Operating System from the Database
                                                                                                                                                                                                                                                                                                                                                                                    An attacker is able to leverage access gained to the database to read / write data to the file system, compromise the operating system, create a tunnel for accessing the host machine, and use this access to potentially attack other machines on the same network as the database machine.
                                                                                                                                                                                                                                                                                                                                                                                    • IMAP/SMTP Command Injection
                                                                                                                                                                                                                                                                                                                                                                                      An attacker exploits weaknesses in input validation on IMAP/SMTP servers to execute commands on the server.
                                                                                                                                                                                                                                                                                                                                                                                      • OS Command Injection
                                                                                                                                                                                                                                                                                                                                                                                        In this type of an attack, an adversary injects operating system commands into existing application functions.
                                                                                                                                                                                                                                                                                                                                                                                        • Local Execution of Code
                                                                                                                                                                                                                                                                                                                                                                                          An adversary installs and executes malicious code on the target system in an effort to achieve a negative technical impact.
                                                                                                                                                                                                                                                                                                                                                                                          • Targeted Malware
                                                                                                                                                                                                                                                                                                                                                                                            An adversary develops targeted malware that takes advantage of a known vulnerability in an organizational information technology environment.
                                                                                                                                                                                                                                                                                                                                                                                            • Install New Service
                                                                                                                                                                                                                                                                                                                                                                                              When an operating system starts, it also starts programs called services or daemons.
                                                                                                                                                                                                                                                                                                                                                                                              • Install Rootkit
                                                                                                                                                                                                                                                                                                                                                                                                A hypervisor is a software layer that sits between the operating system and the processor.
                                                                                                                                                                                                                                                                                                                                                                                                • Schedule Software To Run
                                                                                                                                                                                                                                                                                                                                                                                                  It is possible to schedule software to be run at a time in the future (Windows commands "at" and "schtasks", along with the Windows Task Scheduler, cron in UNIX-based systems).
                                                                                                                                                                                                                                                                                                                                                                                                  • Replace Trusted Executable
                                                                                                                                                                                                                                                                                                                                                                                                    An attacker replaces replaces a trusted executable to allow for the execution of malware when that trusted executable is called.
                                                                                                                                                                                                                                                                                                                                                                                                    • Run Software at Logon
                                                                                                                                                                                                                                                                                                                                                                                                      Operating system allows logon scripts to be run whenever a specific user or users logon to a system.
                                                                                                                                                                                                                                                                                                                                                                                                      • Traffic Injection
                                                                                                                                                                                                                                                                                                                                                                                                        An adversary injects traffic into the target's network connection.
                                                                                                                                                                                                                                                                                                                                                                                                        • Connection Reset
                                                                                                                                                                                                                                                                                                                                                                                                          In this attack pattern, an adversary injects a connection reset packet to one or both ends of a target's connection.
                                                                                                                                                                                                                                                                                                                                                                                                          • TCP RST Injection
                                                                                                                                                                                                                                                                                                                                                                                                            An adversary injects one or more TCP RST packets to a target after the target has made a HTTP GET request.
                                                                                                                                                                                                                                                                                                                                                                                                            • Object Injection
                                                                                                                                                                                                                                                                                                                                                                                                              An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects.
                                                                                                                                                                                                                                                                                                                                                                                                              • Employ Probabilistic Techniques
                                                                                                                                                                                                                                                                                                                                                                                                                An attacker utilizes probabilistic techniques to explore and overcome security properties of the target that are based on an assumption of strength due to the extremely low mathematical probability that an attacker would be able to identify and exploit the very rare specific conditions under which those security properties do not hold.
                                                                                                                                                                                                                                                                                                                                                                                                                • Brute Force
                                                                                                                                                                                                                                                                                                                                                                                                                  In this attack, some asset (information, functionality, identity, etc.
                                                                                                                                                                                                                                                                                                                                                                                                                  • Encryption Brute Forcing
                                                                                                                                                                                                                                                                                                                                                                                                                    An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.
                                                                                                                                                                                                                                                                                                                                                                                                                    • Fuzzing
                                                                                                                                                                                                                                                                                                                                                                                                                      In this attack pattern, the adversary leverages fuzzing to try to identify weaknesses in the system.
                                                                                                                                                                                                                                                                                                                                                                                                                      • Collect and Analyze Information
                                                                                                                                                                                                                                                                                                                                                                                                                        This category has been deprecated as it is no longer used by any of the Views.
                                                                                                                                                                                                                                                                                                                                                                                                                        • Excavation
                                                                                                                                                                                                                                                                                                                                                                                                                          An adversary actively probes the target in a manner that is designed to solicit information that could be leveraged for malicious purposes.
                                                                                                                                                                                                                                                                                                                                                                                                                          • Dumpster Diving
                                                                                                                                                                                                                                                                                                                                                                                                                            An adversary cases an establishment and searches through trash bins, dumpsters, or areas where company information may have been accidentally discarded for information items which may be useful to the dumpster diver.
                                                                                                                                                                                                                                                                                                                                                                                                                            • Pull Data from System Resources
                                                                                                                                                                                                                                                                                                                                                                                                                              An adversary who is authorized or has the ability to search known system resources, does so with the intention of gathering useful information.
                                                                                                                                                                                                                                                                                                                                                                                                                              • Probe Application Memory
                                                                                                                                                                                                                                                                                                                                                                                                                                An adversary obtains unauthorized information due to insecure or incomplete data deletion in a multi-tenant environment.
                                                                                                                                                                                                                                                                                                                                                                                                                                • Probe iOS Screenshots
                                                                                                                                                                                                                                                                                                                                                                                                                                  An adversary examines screenshot images created by iOS in an attempt to obtain sensitive information.
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Obtain Data via Utilities
                                                                                                                                                                                                                                                                                                                                                                                                                                    In this type of attack, information useful to adversaries in launching follow-on attacks is obtained through the use of helper tools or utilities.
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Dump Password Hashes
                                                                                                                                                                                                                                                                                                                                                                                                                                      An adversary obtains a collection of password hashes through the use of automated utilities designed specifically for gathering this type of information.
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Interception
                                                                                                                                                                                                                                                                                                                                                                                                                                        An adversary monitors data streams to or from a target in order to gather information.
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Intent Intercept
                                                                                                                                                                                                                                                                                                                                                                                                                                          An adversary, through a previously installed malicious application, intercepts messages from a trusted Android-based application in an attempt to achieve a variety of different objectives including denial of service, information disclosure, and data injection.
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Activity Hijack
                                                                                                                                                                                                                                                                                                                                                                                                                                            An adversary, through a previously installed malicious application, intercepts an implicit intent sent to launch a trusted activity and instead launches a counterfeit activity in its place.
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Sniffing Attacks
                                                                                                                                                                                                                                                                                                                                                                                                                                              An attacker monitors information transmitted between logical or physical nodes of a network.
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Cellular Traffic Intercept
                                                                                                                                                                                                                                                                                                                                                                                                                                                Cellular traffic for voice and data from mobile devices and retransmission devices can be intercepted via numerous methods.
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Sniffing Network Traffic
                                                                                                                                                                                                                                                                                                                                                                                                                                                  An adversary monitors network traffic between nodes of a public or multicast network in an attempt to capture sensitive information.
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Sniff Application Code
                                                                                                                                                                                                                                                                                                                                                                                                                                                    An adversary passively sniffs network communications and captures application code bound for an authorized client.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Footprinting
                                                                                                                                                                                                                                                                                                                                                                                                                                                      An adversary engages in probing and exploration activities to identify constituents and properties of the target.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Malware-Directed Internal Reconnaissance
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Adversary uses malware or a similarly controlled application installed inside an organizational perimeter to gather information about the composition, configuration, and security mechanisms of a targeted application, system or network.
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Port Scanning
                                                                                                                                                                                                                                                                                                                                                                                                                                                          An attacker uses a combination of techniques to determine the state of the ports on a remote target.
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • TCP Connect Scan
                                                                                                                                                                                                                                                                                                                                                                                                                                                            An attacker uses full TCP connection attempts to determine if a port is open.
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • TCP FIN scan
                                                                                                                                                                                                                                                                                                                                                                                                                                                              An attacker uses a TCP FIN scan to determine if ports are closed on the target machine.
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • TCP Xmas Scan
                                                                                                                                                                                                                                                                                                                                                                                                                                                                An attacker uses a TCP XMAS scan to determine if ports are closed on the target machine.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • TCP Null Scan
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  An attacker uses a TCP NULL scan to determine if ports are closed on the target machine.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • TCP ACK Scan
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    An attacker uses TCP ACK segments to gather information about firewall or ACL configuration.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • TCP Window Scan
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      An attacker engages in TCP Window scanning to analyze port status and operating system type.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • TCP RPC Scan
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        An attacker scan for RPC services listing on a Unix/Linux host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • UDP Scan
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          An attacker engages in UDP scanning to gather information about UDP port status.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • TCP SYN Scan
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            An attacker uses a SYN scan to determine the status of ports on the remote target.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Account Footprinting
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Adversaries may attempt to get a listing of all local or domain accounts and their permissions.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Application Footprinting
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                An adversary engages in active probing and exploration activities to determine the type or version of an application installed on a remote target.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Host Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  An attacker sends a probe to an IP address to determine if the host is alive.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • WiFi MAC Address Tracking
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    In this attack scenario, the attacker passively listens for WiFi messages and logs the associated Media Access Control (MAC) addresses.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • WiFi SSID Tracking
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      In this attack scenario, the attacker passively listens for WiFi management frame messages containing the Service Set Identifier (SSID) for the WiFi network.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Signal Strength Tracking
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        In this attack scenario, the attacker passively monitors the signal strength of the target’s cellular RF signal or WiFi RF signal and uses the strength of the signal (with directional antennas and/or from multiple listening points at once) to identify the source location of the signal.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • ICMP Echo Request Ping
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          An adversary sends out an ICMP Type 8 Echo Request, commonly known as a 'Ping', in order to determine if a target system is responsive.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • ICMP Address Mask Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            An attacker sends an ICMP Type 17 Address Mask Request to gather information about a target's networking configuration.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • ICMP Timestamp Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              An adversary sends an ICMP type 13 Timestamp Request to determine the time as recorded by a remote target.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • ICMP Information Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                An adversary sends an ICMP Information Request to a host to determine if it will respond to this deprecated mechanism.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • TCP ACK Ping
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  An attacker sends a TCP segment with the ACK flag set to a remote host for the purpose of determining if the host is alive.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UDP Ping
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    An attacker sends a UDP datagram to the remote host to determine if the host is alive.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • TCP SYN Ping
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      An attacker uses a TCP SYN packets as a means of purpose of host discovery.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Fingerprinting
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        An adversary compares output from a target system to known indicators that uniquely identify specific details about the target.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Application Fingerprinting
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          An adversary engages in fingerprinting activities to determine the type or version of an application installed on a remote target.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Scanning for Vulnerable Software
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            An attacker engages in scanning activity to find vulnerable software versions or types, such as operating system versions or network services.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Browser Fingerprinting
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Web Application Fingerprinting
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                An attacker sends a series of probes to a web application in order to elicit version-dependent and type-dependent behavior that assists in identifying the target.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • AJAX Fingerprinting
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  This attack utilizes the frequent client-server roundtrips in Ajax conversation to scan a system.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Active OS Fingerprinting
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    An adversary engages in activity to detect the operating system or firmware version of a remote target by interrogating a device, server, or platform with a probe designed to solicit behavior that will reveal information about the operating systems or firmware in the environment.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • IP ID Sequencing Probe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      This OS fingerprinting probe analyzes the IP 'ID' field sequence number generation algorithm of a remote host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • TCP Timestamp Probe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        This OS fingerprinting probe examines the remote server's implementation of TCP timestamps.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • TCP (ISN) Counter Rate Probe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          This OS detection probe measures the average rate of initial sequence number increments during a period of time.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • TCP Options Probe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            This OS fingerprinting probe analyzes the type and order of any TCP header options present within a response segment.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • TCP 'RST' Flag Checksum Probe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              This OS fingerprinting probe performs a checksum on any ASCII data contained within the data portion or a RST packet.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • ICMP Error Message Quoting Probe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                An adversary uses a technique to generate an ICMP Error message (Port Unreachable, Destination Unreachable, Redirect, Source Quench, Time Exceeded, Parameter Problem) from a target and then analyze the amount of data returned or "Quoted" from the originating request that generated the ICMP error message.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • ICMP Error Message Echoing Integrity Probe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  An adversary uses a technique to generate an ICMP Error message (Port Unreachable, Destination Unreachable, Redirect, Source Quench, Time Exceeded, Parameter Problem) from a target and then analyze the integrity of data returned or "Quoted" from the originating request that generated the error message.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • ICMP IP Total Length Field Probe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    An adversary sends a UDP packet to a closed port on the target machine to solicit an IP Header's total length field value within the echoed 'Port Unreachable" error message.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • ICMP IP 'ID' Field Error Message Probe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      An adversary sends a UDP datagram having an assigned value to its internet identification field (ID) to a closed port on a target to observe the manner in which this bit is echoed back in the ICMP error message.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Passive OS Fingerprinting
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        An adversary engages in activity to detect the version or type of OS software in a an environment by passively monitoring communication between devices, nodes, or applications.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Reverse Engineering
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          An adversary discovers the structure, function, and composition of an object, resource, or system by using a variety of analysis techniques to effectively determine how the analyzed entity was constructed or operates.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • White Box Reverse Engineering
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            An attacker discovers the structure, function, and composition of a type of computer software through white box analysis techniques.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Smudge Attack
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Attacks that reveal the password/passcode pattern on a touchscreen device by detecting oil smudges left behind by the user’s fingers.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Read Sensitive Strings Within an Executable
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                An adversary engages in activities to discover any sensitive strings are present within the compiled code of an executable, such as literal ASCII strings within the file itself, or possibly strings hard-coded into particular routines that can be revealed by code refactoring methods including static and dynamic analysis.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Black Box Reverse Engineering
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  An attacker discovers the structure, function, and composition of a type of computer software through black box analysis techniques.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Electromagnetic Side-Channel Attack
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    In this attack scenario, the attacker passively monitors electromagnetic emanations that are produced by the targeted electronic device as an unintentional side-effect of its processing.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Compromising Emanations Attack
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Compromising Emanations (CE) are defined as unintentional signals which an attacker may intercept and analyze to disclose the information processed by the targeted equipment.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Protocol Analysis
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        An adversary engages in activities to decipher and/or decode protocol information for a network or application communication protocol used for transmitting information between interconnected nodes or systems on a packet-switched data network.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Cryptanalysis
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Cryptanalysis is a process of finding weaknesses in cryptographic algorithms and using these weaknesses to decipher the ciphertext without knowing the secret key (instance deduction).
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Cryptanalysis of Cellular Encryption
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            The use of cryptanalytic techniques to derive cryptographic keys or otherwise effectively defeat cellular encryption to reveal traffic content.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Padding Oracle Crypto Attack
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              An adversary is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Information Elicitation
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                An adversary engages an individual using any combination of social engineering methods for the purpose of extracting information.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Physical TheftCloning RFID Cards or ChipsMagnetic Strip Card Brute Force AttacksCloning Magnetic Strip CardsRFID Chip Deactivation or DestructionBypassing Card or Badge-Based SystemsBypassing Electronic Locks and Access ControlsUsing a Snap Gun Lock to Force a LockLock PickingLock BumpingBypassing Physical LocksBypassing Physical SecurityTarget Programs with Elevated PrivilegesUsing URL/codebase / G.A.C. (code source) to convince sandbox of privilegeCalling Signed Code From Another Language Within A Sandbox Allow This Lifting signing key and signing malicious code from a production environmentSubvert Code-signing FacilitiesCatching exception throw/signal from privileged blockImplementing a callback to system routine (old AWT Queue)Hijacking a Privileged Thread of ExecutionHijacking a privileged processCross Zone ScriptingPrivilege EscalationExploiting Incorrectly Configured Access Control Security LevelsXML External EntitiesWebView ExposureRestful Privilege ElevationAdd Malicious File to Shared WebrootModify Shared FileAccessing, Modifying or Executing Executable FilesAccessing Functionality Not Properly Constrained by ACLsPrivilege AbuseUtilizing REST's Trust in the System Resource to Register Man in the MiddleContent Spoofing Via Application API ManipulationApplication API Button HijackingNavigation Remapping To Propagate Malicious ContentApplication API Navigation RemappingTransaction or Event Tampering via Application API ManipulationApplication API Message Manipulation via Man-in-the-MiddleLeveraging Active Man in the Middle Attacks to Bypass Same Origin PolicyXML Routing Detour AttacksMan in the Middle AttackManipulating Hidden FieldsSubverting Environment Variable ValuesManipulating User-Controlled VariablesAccessing/Intercepting/Modifying HTTP CookiesManipulating Opaque Client-based Data TokensSubversion of authorization checks: cache filtering, programmatic security, etc.Removing/short-circuiting 'Purse' logic: removing/mutating 'cash' decrementsRemoval of filters: Input filters, output filters, data maskingRemoving Important Client FunctionalityCreate Malicious ClientExploiting Trust in ClientForceful BrowsingWeb Services API Signature Forgery Leveraging Hash Function Extension WeaknessAuthentication BypassUnauthorized Use of Device ResourcesAuthentication AbuseSession Credential Falsification through PredictionSession Credential Falsification through ManipulationSession Credential Falsification through ForgingCross Site IdentificationCross Site Request ForgerySession FixationReusing Session IDs (aka Session Replay)Cross Site TracingSession SidejackingSession HijackingWindows Admin Shares with Stolen CredentialsRemote Services with Stolen CredentialsUse of Known Domain CredentialsSaaS User Request ForgeryExploitation of Trusted CredentialsSubvert Access ControlInformation ElicitationPadding Oracle Crypto AttackCryptanalysis of Cellular EncryptionCryptanalysisProtocol AnalysisCompromising Emanations AttackElectromagnetic Side-Channel AttackAnalysis of Packet Timing and SizesBlack Box Reverse EngineeringRead Sensitive Strings Within an ExecutableReverse Engineer an Executable to Expose Assumed Hidden Functionality or ContentRetrieve Embedded Sensitive DataLifting Sensitive Data Embedded in CacheSmudge AttackWhite Box Reverse EngineeringReverse EngineeringPassive OS FingerprintingICMP IP 'ID' Field Error Message ProbeICMP IP Total Length Field ProbeICMP Error Message Echoing Integrity ProbeICMP Error Message Quoting ProbeTCP 'RST' Flag Checksum ProbeTCP Options ProbeTCP Initial Window Size ProbeTCP Congestion Control Flag (ECN) ProbeTCP (ISN) Sequence Predictability ProbeTCP (ISN) Counter Rate ProbeTCP (ISN) Greatest Common Divisor ProbeTCP Sequence Number ProbeTCP Timestamp ProbeIP (DF) 'Don't Fragment Bit' Echoing ProbeIP 'ID' Echoed Byte-Order ProbeIP ID Sequencing ProbeActive OS FingerprintingAJAX FingerprintingWeb Application FingerprintingBrowser FingerprintingScanning for Vulnerable SoftwareApplication FingerprintingFingerprintingTCP SYN PingUDP PingTCP ACK PingICMP Information RequestICMP Timestamp RequestICMP Address Mask RequestICMP Echo Request PingSignal Strength TrackingCellular Broadcast Message RequestWiFi SSID TrackingWiFi MAC Address TrackingHost DiscoveryExplore for Predictable Temporary File NamesSecurity Software FootprintingApplication FootprintingOwner FootprintingGroup Permission FootprintingAccount FootprintingServices FootprintingProcess FootprintingTraceroute Route EnumerationDNS Zone TransfersEnumerate Mail Exchange (MX) RecordsNetwork Topology MappingTCP SYN ScanUDP ScanTCP RPC ScanTCP Window ScanTCP ACK ScanTCP Null ScanTCP Xmas ScanTCP FIN scanTCP Connect ScanPort ScanningMalware-Directed Internal ReconnaissanceFootprintingSniff Application CodeSniffing Network TrafficCellular Traffic InterceptSniffing AttacksHarvesting Usernames or UserIDs via Application API Event MonitoringActivity HijackIntent InterceptInterceptionWSDL ScanningFuzzing for garnering other adjacent user/sensitive dataDirectory IndexingCross-Domain Search TimingFuzzing and observing application log data/errors for application mappingFuzzing for garnering J2EE/.NET-based stack traces, for application mappingQuery System for InformationScreen Temporary Files for Sensitive InformationDetect Unpublicized Web ServicesDetect Unpublicized Web PagesCollect Data from Common Resource LocationsCapture Credentials via KeyloggerCollect Data as Provided by UsersDump Password HashesObtain Data via UtilitiesProbe iOS ScreenshotsProbe Application MemoryPull Data from System ResourcesDumpster DivingExcavationCollect and Analyze InformationBypassing of Intermediate Forms in Multiple-Form SetsManipulating User StateLeveraging Time-of-Check and Time-of-Use (TOCTOU) Race ConditionsLeveraging Race Conditions via Symbolic LinksLeveraging Race ConditionsForced DeadlockManipulate Timing and StateFuzzingTry Common or Default Usernames and PasswordsRainbow Table Password CrackingDictionary-based Password AttackPassword Brute ForcingEncryption Brute ForcingBrute ForceEmploy Probabilistic TechniquesObject InjectionTCP RST InjectionConnection ResetTraffic InjectionMobile Device Fault InjectionFault InjectionReplace Winlogon Helper DLLRun Software at LogonReplace Trusted ExecutableSchedule Software To RunReplace File Extension HandlersInstall Rootkit Modify Existing ServiceInstall New ServiceTargeted MalwareLocal Execution of CodeOS Command InjectionIMAP/SMTP Command InjectionSQL Injection through SOAP Parameter TamperingExpanding Control over the Operating System from the DatabaseObject Relational Mapping InjectionCommand Line Execution through SQL InjectionBlind SQL InjectionSQL InjectionLDAP InjectionXQuery InjectionXPath InjectionDTD InjectionXML InjectionManipulating Writeable Terminal DevicesLinux Terminal InjectionCommand InjectionXSS Using MIME Type MismatchStored XSSXSS Using Alternate SyntaxXSS Targeting Error PagesXSS Through HTTP HeadersXSS Through HTTP Query StringsXSS Using Invalid CharactersXSS Using Doubled CharactersXSS Targeting URI PlaceholdersXSS Targetting HTML AttributesXSS Targeting Non-Script ElementsReflected XSSDOM-Based XSSCross-Site Scripting (XSS)Using Meta-characters in E-mail Headers to Inject Malicious PayloadsFile Content InjectionEmbedding Scripts within ScriptsGeneric Cross-Browser Cross-Domain TheftCode InjectionCellular Data InjectionResource InjectionPHP Remote File InclusionServer Side Include (SSI) InjectionWebView InjectionRemote Code InclusionPHP Local File InclusionLocal Code InclusionCode InclusionCross-Site FlashingFlash InjectionFlash Parameter InjectionReflection InjectionFormat String InjectionEmail InjectionHTTP Parameter Pollution (HPP)Command DelimitersArgument InjectionParameter InjectionInject Unexpected ItemsContaminate ResourceFlash Memory AttacksUSB Memory AttacksMalicious Logic Insertion into Product MemoryMalicious Logic Insertion into Product HardwareMalware Infection into Product SoftwareOpen Source Libraries AlteredAltered Installed BIOSMalicious Logic Inserted Into To Product SoftwareMalicious Logic InsertionRogue Integration ProceduresMalicious Software ImplantedMalicious Hardware Component ReplacementManipulation During DistributionHardware Design Specifications Are AlteredDocumentation Alteration to Cause Errors in System DesignDocumentation Alteration to Produce Under-performing SystemsDocumentation Alteration to Circumvent Dial-downDesign AlterationMalicious Logic Insertion into Product Software via Inclusion of 3rd Party Component DependencyMalicious Logic Insertion into Product Software via Configuration Management ManipulationMalicious Logic Inserted Into Product Software by Authorized DeveloperASIC With Malicious FunctionalityInfiltration of Hardware Development EnvironmentCounterfeit Hardware Component Inserted During Product AssemblyHardware Component Substitution During BaseliningInfiltration of Software Development EnvironmentDevelopment AlterationModification During ManufactureDNS Domain SeizureBGP Route DisablingDisabling Network HardwareRoute DisablingPhysical Destruction of Device or ComponentBlock Access to LibrariesIP Address BlockingDNS BlockingBlockageOrbital JammingCellular JammingWi-Fi JammingJammingObstructionManipulating Writeable Configuration FilesXML Schema PoisoningSchema PoisoningDisable Security SoftwarePoison Web Service RegistryModification of Registry Run KeysManipulate Application Registry ValuesData Injected During ConfigurationConfiguration/Environment ManipulationUser-Controlled FilenameCreate files with the same name as files protected with a higher classificationForce Use of Corrupted FilesLeverage Executable Code in Non-Executable FilesCause Web Server MisclassificationFile ManipulationForce the System to Reset ValuesLog Injection-Tampering-ForgingWeb Logs TamperingAudit Log ManipulationDNS Cache PoisoningCache PoisoningBlock Logging to Central RepositoryInfrastructure ManipulationMalicious Gray Market HardwareProvide Counterfeit ComponentHardware Component SubstitutionMalicious Hardware UpdateBypassing ATA Password SecurityHacking HardwareHardware Integrity AttackMalicious Automated Software UpdateMalicious Manual Software UpdateRooting SIM CardsMalicious Software UpdateMalicious Software DownloadSoftware Integrity AttackManipulate System ResourcesUsing UTF-8 Encoding to Bypass Validation LogicUsing Slashes in Alternate EncodingUsing Escaped Slashes in Alternate EncodingURL EncodingUsing Unicode Encoding to Bypass Validation LogicUsing Slashes and URL Encoding Combined to Bypass Validation LogicPostfix, Null Terminate, and BackslashEmbedding NULL BytesExploiting Multiple Input Interpretation LayersDouble EncodingUsing Alternative IP Address EncodingsUsing Leading 'Ghost' Character Sequences to Bypass Input FiltersLeverage Alternate EncodingForced Integer OverflowInteger AttacksManipulating Web Input to File System CallsRelative Path TraversalAbsolute Path TraversalPath TraversalInput Data ManipulationPointer ManipulationShared Data ManipulationString Format Overflow in syslog()Buffer Overflow via Parameter ExpansionOverflow Variables and TagsBuffer Overflow via Symbolic LinksOverflow Binary Resource FileMIME ConversionSOAP Array OverflowFilter Failure through Buffer OverflowClient-side Injection-induced Buffer OverflowBuffer Overflow via Environment VariablesBuffer Overflow in Local Command-Line UtilitiesBuffer Overflow in an API CallOverflow BuffersOverread BuffersBuffer ManipulationManipulate Data StructuresCalling Micro-Services DirectlyTransparent Proxy AbuseEvercookieFunctionality BypassWindows ::DATA Alternate Data StreamSOAP Parameter TamperingSoap ManipulationWeb Services Protocol ManipulationData Interchange Protocol ManipulationInter-component Protocol ManipulationDNS RebindingReflection Attack in Authentication ProtocolHTTP Verb TamperingHTTP Response SmugglingHTTP Response SplittingHTTP Request SmugglingHTTP Request SplittingBlue BoxingClient-Server Protocol ManipulationProtocol ManipulationHTTP DoSSustained Client EngagementChoosing Message IdentifierExploiting Incorrectly Configured SSLCommunication Channel ManipulationPassword Recovery ExploitationPassing Local Filenames to Functions That Expect a URLJSON Hijacking (aka JavaScript Hijacking)Weakening of Cellular EncryptionDrop Encryption LevelInducing Account LockoutFunctionality MisuseResource Leak ExposureICMP FragmentationUDP FragmentationTCP FragmentationSOAP Array BlowupRegular Expression Exponential BlowupXML Attribute BlowupXML Entity BlowupXML Oversized PayloadsXML Entity ExpansionXML Quadratic ExpansionXML Nested PayloadsExcessive AllocationAmplificationSSL FloodHTTP FloodICMP FloodUDP FloodTCP FloodXML Ping of the DeathXML FloodFloodingExploit Script-Based APIsUsing Unpublished APIsTry All Common SwitchesExploit Test APIsAPI ManipulationAbuse Existing FunctionalityTarget Influence via Instant RapportTarget Influence via Interview and InterrogationTarget Influence via The Human Buffer OverflowTarget Influence via Voice in NLPTarget Influence via Neuro-Linguistic Programming (NLP)Target Influence via Micro-ExpressionsTarget Influence via Eye CuesInfluence via Modes of ThinkingInfluence via Psychological PrinciplesInfluence via IncentivesTarget Influence via FramingInfluence Perception of Consensus or Social ProofInfluence Perception of LikingInfluence Perception of Commitment and ConsistencyInfluence Perception of AuthorityInfluence Perception of ScarcityInfluence Perception of ReciprocationInfluence PerceptionPretexting via PhonePretexting via Delivery PersonPretexting via Tech SupportPretexting via Customer ServicePretextingManipulate Human BehaviorFlash File OverlayiFrame OverlayClickjackingTapjackingScheme SquattingTask ImpersonationAction SpoofingLeveraging/Manipulating Configuration File Search PathsSymlink AttackDLL Search Order HijackingRedirect Access to LibrariesHomograph Attack via HomoglyphsSoundSquattingTypoSquattingCellular Rogue Base StationEvil Twin Wi-Fi AttackBitSquattingEstablish Rogue LocationResource Location SpoofingMobile PhishingSpear PhishingPhishingTerrestrial JammingCross Frame Scripting (XFS)Principal SpoofDNS SpoofingCounterfeit OrganizationsCounterfeit WebsitesFake the Source of DataPharmingSignature Spoofing by Key RecreationSignature Spoofing by Mixing Signed and Unsigned ContentSignature Spoofing by MisrepresentationSignature Spoofing by Improper ValidationSignature Spoofing by Key TheftCreating a Rogue Certification Authority CertificateSignature SpoofIdentity SpoofingChecksum SpoofingSpoofing of UDDI/ebXML MessagesArtificially Inflate File SizesSignature-Based AvoidanceCarry-Off GPS AttackCounterfeit GPS SignalsIntent SpoofContent SpoofingEngage in Deceptive InteractionsCommon Attack Pattern Enumeration and Classification (CAPEC)