auren-research/cyber-sec huggingface dataset:
An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources. This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.
Medium
Medium

The target must accept service requests from the attacker and the adversary must be able to control the resource allocation associated with this request to be in excess of the normal allocation. The latter is usually accomplished through the presence of a bug on the target that allows the adversary to manipulate variables used in the allocation.

None: No specialized resources are required to execute this type of attack.

Availability
Resource Consumption
A successful excessive allocation attack forces the target system to exhaust its resources, thereby compromising the availability of its service.

Limit the amount of resources that are accessible to unprivileged users.
Assume all input is malicious. Consider all potentially relevant properties when validating input.
Consider uniformly throttling all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Use resource-limiting settings, if possible.

In an Integer Attack, the adversary could cause a variable that controls allocation for a request to hold an excessively large value. Excessive allocation of resources can render a service degraded or unavailable to legitimate users and can even lead to crashing of the target.

1499.003
Endpoint Denial of Service:Application Exhaustion Flood

10
Denial of Service

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Activation_Zone, Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Examples-Instances, Injection_Vector, Payload, Payload_Activation_Impact, Resources_Required, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Related_Weaknesses, Taxonomy_Mappings
An adversary utilizes a resource leak on the target to deplete the quantity of the resource available to service legitimate requests.

Resource leaks most often come in the form of memory leaks where memory is allocated but never released after it has served its purpose, however, theoretically, any other resource that can be reserved can be targeted if the target fails to release the reservation when the reserved resource block is no longer needed.
In this attack, the adversary determines what activity results in leaked resources and then triggers that activity on the target. Since some leaks may be small, this may require a large number of requests by the adversary. However, this attack differs from a flooding attack in that the rate of requests is generally not significant. This is because the lost resources due to the leak accumulate until the target is reset, usually by restarting it. Thus, a resource-poor adversary who would be unable to flood the target can still utilize this attack.
Resource depletion through leak differs from resource depletion through allocation in that, in the former, the adversary may not be able to control the size of each leaked allocation, but instead allows the leak to accumulate until it is large enough to affect the target's performance. When depleting resources through allocation, the allocated resource may eventually be released by the target so the attack relies on making sure that the allocation size itself is prohibitive of normal operations by the target.

Medium
Medium

The target must have a resource leak that the adversary can repeatedly trigger.

None: No specialized resources are required to execute this type of attack.

Availability
Unreliable Execution
Resource Consumption
A successful resource leak exposure attack compromises the availability of the target system's services.

If possible, leverage coding language(s) that do not allow this weakness to occur (e.g., Java, Ruby, and Python all perform automatic garbage collection that releases memory for objects that have been deallocated).
Memory should always be allocated/freed using matching functions (e.g., malloc/free, new/delete, etc.)
Implement best practices with respect to memory management, including the freeing of all allocated resources at all exit points and ensuring consistency with how and where memory is freed in a function.

1499
Endpoint Denial of Service

10
Denial of Service

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Activation_Zone, Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Injection_Vector, Payload, Payload_Activation_Impact, Resources_Required, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description
An attacker attempts to invoke all common switches and options in the target application for the purpose of discovering weaknesses in the target. For example, in some applications, adding a --debug switch causes debugging information to be displayed, which can sometimes reveal sensitive processing or configuration information to an attacker. This attack differs from other forms of API abuse in that the attacker is indiscriminately attempting to invoke options in the hope that one of them will work rather than specifically targeting a known option. Nonetheless, even if the attacker is familiar with the published options of a targeted application this attack method may still be fruitful as it might discover unpublicized functionality.
Medium

1
Explore
[Identify application] Discover an application of interest by exploring service registry listings or by connecting on a known port or some similar means.
Search via internet for known, published applications that allow option switches.
Use automated tools to scan known ports to identify applications that might be accessible

2
Explore
[Authenticate to application] Authenticate to the application, if required, in order to explore it.
Use published credentials to access system.
Find unpublished credentails to access service.
Use other attack pattern or weakness to bypass authentication.

3
Experiment
[Try all common switches] Using manual or automated means, attempt to run the application with many different known common switches. Observe the output to see if any switches seemed to put the application in a non production mode that might give more information.
Manually execute the application with switches such as --debug, --test, --development, --verbose, etc.
Use automated tools to run the application with common switches and observe the output

4
Exploit
[Use sensitive processing or configuration information] Once extra information is observed from an application through the use of a common switch, this information is used to aid other attacks on the application
Using application information, formulate an attack on the application

The attacker must be able to control the options or switches sent to the target.

None: No specialized resources are required to execute this type of attack. The only requirement is the ability to send requests to the target.

Design: Minimize switch and option functionality to only that necessary for correct function of the command.
Implementation: Remove all debug and testing options from production code.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Description

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated Execution_Flow

Try All Common Application Switches and Options
An adversary manipulates the headers and content of an email message by injecting data via the use of delimiter characters native to the protocol.

Many applications allow users to send email messages by filling in fields. For example, a web site may have a link to "share this site with a friend" where the user provides the recipient's email address and the web application fills out all the other fields, such as the subject and body. In this pattern, an adversary adds header and body information to an email message by injecting additional content in an input field used to construct a header of the mail message. This attack takes advantage of the fact that RFC 822 requires that headers in a mail message be separated by a carriage return. As a result, an adversary can inject new headers or content simply by adding a delimiting carriage return and then supplying the new heading and body information. This attack will not work if the user can only supply the message body since a carriage return in the body is treated as a normal character.

Medium

The target application must allow the user to send email to some recipient, to specify the content at least one header field in the message, and must fail to sanitize against the injection of command separators.
The adversary must have the ability to access the target mail application.

None: No specialized resources are required to execute this type of attack.

30
Mail Command Injection

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Attack_Prerequisites, Related_Attack_Patterns, Resources_Required

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description
An adversary manipulates the content of request parameters for the purpose of undermining the security of the target. Some parameter encodings use text characters as separators. For example, parameters in a HTTP GET message are encoded as name-value pairs separated by an ampersand (&). If an attacker can supply text strings that are used to fill in these parameters, then they can inject special characters used in the encoding scheme to add or modify parameters. For example, if user input is fed directly into an HTTP GET request and the user provides the value "myInput&new_param=myValue", then the input parameter is set to myInput, but a new parameter (new_param) is also added with a value of myValue. This can significantly change the meaning of the query that is processed by the server. Any encoding scheme where parameters are identified and separated by text characters is potentially vulnerable to this attack - the HTTP GET encoding used above is just one example.
Medium
Medium

The target application must use a parameter encoding where separators and parameter identifiers are expressed in regular text.
The target application must accept a string as user input, fail to sanitize characters that have a special meaning in the parameter encoding, and insert the user-supplied string in an encoding which is then processed.

None: No specialized resources are required to execute this type of attack. The only requirement is the ability to provide string input to the target.

Integrity
Modify Data
Successful parameter injection attacks mean a compromise to integrity of the application.

Implement an audit log written to a separate host. In the event of a compromise, the audit log may be able to provide evidence and details of the compromise.
Treat all user input as untrusted data that must be validated before use.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Activation_Zone, Attack_Motivation-Consequences, Description Summary, Injection_Vector, Payload, Payload_Activation_Impact, Resources_Required, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Description, Related_Weaknesses
An adversary supplies a value to the target application which is then used by reflection methods to identify a class, method, or field. For example, in the Java programming language the reflection libraries permit an application to inspect, load, and invoke classes and their components by name. If an adversary can control the input into these methods including the name of the class/method/field or the parameters passed to methods, they can cause the targeted application to invoke incorrect methods, read random fields, or even to load and utilize malicious classes that the adversary created. This can lead to the application revealing sensitive information, returning incorrect results, or even having the adversary take control of the targeted application.
Very High

The target application must utilize reflection libraries and allow users to directly control the parameters to these methods. If the adversary can host classes where the target can invoke them, more powerful variants of this attack are possible.
The target application must accept a string as user input, fail to sanitize characters that have a special meaning in the parameter encoding, and insert the user-supplied string in an encoding which is then processed.

None: No specialized resources are required to execute this type of attack.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Attack_Prerequisites, Description Summary, Resources_Required

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Prerequisites

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Weaknesses
Some web applications require users to submit information through an ordered sequence of web forms. This is often done if there is a very large amount of information being collected or if information on earlier forms is used to pre-populate fields or determine which additional information the application needs to collect. An attacker who knows the names of the various forms in the sequence may be able to explicitly type in the name of a later form and navigate to it without first going through the previous forms. This can result in incomplete collection of information, incorrect assumptions about the information submitted by the attacker, or other problems that can impair the functioning of the application.
Medium

The target must collect information from the user in a series of forms where each form has its own URL that the attacker can anticipate and the application must fail to detect attempts to access intermediate forms without first filling out the previous forms.

None: No specialized resources are required to execute this type of attack.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Attack_Patterns
An adversary searches a targeted web site for web pages that have not been publicized. In doing this, the adversary may be able to gain access to information that the targeted site did not intend to make public.
Low

1
Explore
[Find target web site] An adversary finds a target web site that they think may have unpublicized web pages

2
Explore
[Map the published web site] The adversary will map the published web site either by using an automated tool or by manually accessing well-known debugging or logging pages, or otherwise predictable pages within the site tree
Use Dirbuster to brute force directories and file names to find unpublicized pages
Find a pattern in the naming of documents and extrapolate this pattern to discover additional documents that have been created but are no longer externally linked

3
Experiment
[Try to find weaknesses or information] The adversary will try to find weaknesses or information on the unpublicized pages that the targeted site did not intend to be public
Manually analyze files or pages for information that could be useful in a further attack
Use a static analysis tool to find weaknesses in unpublished web pages

4
Exploit
[Follow-up attack] Use any information or weaknesses found to carry out a follow-up attack

The targeted web site must include pages within its published tree that are not connected to its tree of links. The sensitivity of the content of these pages determines the severity of this attack.

Spidering tools to explore the target web site are extremely useful in this attack especially when attacking large sites. Some tools might also be able to automatically construct common page locations from known paths.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated Description, Execution_Flow

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Weaknesses
An adversary searches a targeted web site for web services that have not been publicized. This attack can be especially dangerous since unpublished but available services may not have adequate security controls placed upon them given that an administrator may believe they are unreachable.
Low

1
Explore
[Find target web site] An adversary finds a target web site that they think may have unpublicized web services

2
Explore
[Map the published web site] The adversary will map the published web site either by using an automated tool or by manually accessing well-known debugging or logging pages, or otherwise predictable pages within the site tree
Use Dirbuster to brute force directories and file names to find unpublicized web services
Find a pattern in the naming of documents and extrapolate this pattern to discover additional documents that have been created but are no longer externally linked

3
Experiment
[Try to find weaknesses or information] The adversary will try to find weaknesses in the unpublicized services that the targeted site did not intend to be public
Use Nikto to look for web service vulnerabilities

4
Exploit
[Follow-up attack] Use any information or weaknesses found to carry out a follow-up attack

The targeted web site must include unpublished services within its web tree. The nature of these services determines the severity of this attack.

Spidering tools to explore the target web site are extremely useful in this attack especially when attacking large sites. Some tools might also be able to automatically construct common service queries from known paths.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2015-12-07
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-10-21
Updated Description, Execution_Flow

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Weaknesses
An adversary spoofs a checksum message for the purpose of making a payload appear to have a valid corresponding checksum. Checksums are used to verify message integrity. They consist of some value based on the value of the message they are protecting. Hash codes are a common checksum mechanism. Both the sender and recipient are able to compute the checksum based on the contents of the message. If the message contents change between the sender and recipient, the sender and recipient will compute different checksum values. Since the sender's checksum value is transmitted with the message, the recipient would know that a modification occurred. In checksum spoofing an adversary modifies the message body and then modifies the corresponding checksum so that the recipient's checksum calculation will match the checksum (created by the adversary) in the message. This would prevent the recipient from realizing that a change occurred.
Medium

The adversary must be able to intercept a message from the sender (keeping the recipient from getting it), modify it, and send the modified message to the recipient.
The sender and recipient must use a checksum to protect the integrity of their message and transmit this checksum in a manner where the adversary can intercept and modify it.
The checksum value must be computable using information known to the adversary. A cryptographic checksum, which uses a key known only to the sender and recipient, would thwart this attack.

The adversary must have a utility that can intercept and modify messages between the sender and recipient.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-08-04
Updated Attack_Prerequisites, Description Summary, Resources_Required

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns, Related_Weaknesses