auren-research/cyber-sec huggingface dataset:
This OS fingerprinting probe checks the initial TCP Window size. TCP stacks limit the range of sequence numbers allowable within a session to maintain the "connected" state within TCP protocol logic. The initial window size specifies a range of acceptable sequence numbers that will qualify as a response to an ACK packet within a session. Various operating systems use different Initial window sizes. The initial window size can be sampled by establishing an ordinary TCP connection.
Medium
Low

The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.

A tool capable of sending and receiving packets from a remote system.

Confidentiality
Read Data

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism
Hide Activities

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Related_Attack_Patterns, Resources_Required, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Related_Weaknesses
This OS fingerprinting probe analyzes the type and order of any TCP header options present within a response segment. Most operating systems use unique ordering and different option sets when options are present. RFC 793 does not specify a required order when options are present, so different implementations use unique ways of ordering or structuring TCP options. TCP options can be generated by ordinary TCP traffic.
Medium
Low

The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.

A tool capable of sending and receiving packets from a remote system.

Confidentiality
Read Data

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism
Hide Activities

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Related_Attack_Patterns, Resources_Required, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Related_Weaknesses
This OS fingerprinting probe performs a checksum on any ASCII data contained within the data portion or a RST packet. Some operating systems will report a human-readable text message in the payload of a 'RST' (reset) packet when specific types of connection errors occur. RFC 1122 allows text payloads within reset packets but not all operating systems or routers implement this functionality.
Medium
Low

The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.

A tool capable of sending and receiving packets from a remote system.

Confidentiality
Read Data

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism
Hide Activities

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Related_Attack_Patterns, Resources_Required, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Related_Weaknesses
An adversary uses a technique to generate an ICMP Error message (Port Unreachable, Destination Unreachable, Redirect, Source Quench, Time Exceeded, Parameter Problem) from a target and then analyze the amount of data returned or "Quoted" from the originating request that generated the ICMP error message.

For this purpose "Port Unreachable" error messages are often used, as generating them requires the adversary to send a UDP datagram to a closed port on the target. The goal of this analysis to make inferences about the type of operating system or firmware that sent the error message in reply.
This is useful for identifying unique characteristics of operating systems because the RFC-1122 expected behavior reads: "Every ICMP error message includes the Internet header and at least the first 8 data octets of the datagram that triggered the error; more than 8 octets MAY be sent [...]." This contrasts with RFC-792 expected behavior, which limited the quoted text to 64 bits (8 octets). Given the latitude in the specification the resulting RFC-1122 stack implementations often respond with a high degree of variability in the amount of data quoted in the error message because "older" or "legacy" stacks may comply with the RFC-792 specification, while other stacks may choose a longer format in accordance with RFC-1122. As a general rule most operating systems or firmware will quote the first 8 bytes of the datagram triggering the error, but some IP stacks will quote more than the first 8 bytes of data.

Medium
Low

The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.

A tool capable of sending/receiving UDP datagram packets from a remote system to a closed port and receive an ICMP Error Message Type 3, "Port Unreachable..

Confidentiality
Read Data

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism
Hide Activities

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Related_Attack_Patterns, Resources_Required, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description
An adversary uses a technique to generate an ICMP Error message (Port Unreachable, Destination Unreachable, Redirect, Source Quench, Time Exceeded, Parameter Problem) from a target and then analyze the integrity of data returned or "Quoted" from the originating request that generated the error message.

A tremendous amount of information about the host operating system can be deduced from its 'echoing' characteristics. Notably, inspection of key protocol header fields, including the echoed header fields of the encapsulating protocol can yield a wealth of data about the host operating system or firmware version.
For this purpose "Port Unreachable" error messages are often used, as generating them requires the adversary to send a UDP datagram to a closed port on the target. When replying with an ICMP error message some IP/ICMP stack implementations change aspects of the IP header, change or reverse certain byte orders, reset certain field values to default values which differ between operating system and firmware implementations, and make other changes. Some IP/ICMP stacks are decidedly broken, indicating an idiosyncratic behavior that differs from the RFC specifications, such as the case when miscalculations affect a field value.

Medium
Low

The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.

A tool capable of sending/receiving UDP datagram packets from a remote system to a closed port and receive an ICMP Error Message Type 3, "Port Unreachable..

Confidentiality
Read Data

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism
Hide Activities

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Related_Attack_Patterns, Resources_Required, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description
An adversary sends a UDP packet to a closed port on the target machine to solicit an IP Header's total length field value within the echoed 'Port Unreachable" error message. This type of behavior is useful for building a signature-base of operating system responses, particularly when error messages contain other types of information that is useful identifying specific operating system responses.

RFC1122 specifies that the Header of the request must be echoed back when an error is sent in response, but some operating systems and firmware alter the integrity of the original header. Non-standard ICMP/IP implementations result in response that are useful for individuating remote operating system or router firmware versions. There are four general response types that can be used to distinguish operating systems apart: 1) the IP total length field may be calculated correctly, 2) an operating system may add 20 or more additional bytes to the length calculation, 3) the operating system may subtract 20 or more bytes from the correct length of the field or 4) the IP total length field is calculated with any other incorrect value.

Medium
Low

The ability to monitor and interact with network communications. Access to at least one host, and the privileges to interface with the network interface card.

A tool capable of sending/receiving UDP datagram packets from a remote system to a closed port and receive an ICMP Error Message Type 3, "Port Unreachable."

Confidentiality
Read Data

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism
Hide Activities

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Related_Attack_Patterns, Resources_Required, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description, Description Summary

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Weaknesses, Resources_Required
An adversary sends a UDP datagram having an assigned value to its internet identification field (ID) to a closed port on a target to observe the manner in which this bit is echoed back in the ICMP error message. This allows the attacker to construct a fingerprint of specific OS behaviors.

The internet identification field (ID) is typically utilized for reassembling a fragmented packet. RFC791 and RFC815 discusses about IP datagrams, fragmentation and reassembly. Some operating systems or router firmware reverse the bit order of the ID field when echoing the IP Header portion of the original datagram within the ICMP error message. There are three behaviors related to the IP ID field that can be used to distinguish remote operating systems or firmware: 1) it is echoed back identically to the bit order of the ID field in the original IP header, 2) it is echoed back, but the byte order has been reversed, or it contains an incorrect or unexpected value. Different operating systems will respond by setting the IP ID field differently within error messaging.

Medium
Low

The ability to monitor and interact with network communications. Access to at least one host, and the privileges to interface with the network interface card.

A tool capable of sending/receiving UDP datagram packets from a remote system to a closed port and receive an ICMP Error Message Type 3, "Port Unreachable."

Confidentiality
Read Data

Confidentiality
Access Control
Authorization
Bypass Protection Mechanism
Hide Activities

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2017-05-01
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Related_Attack_Patterns, Resources_Required, Typical_Likelihood_of_Exploit

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description, Description Summary

CAPEC Content Team
The MITRE Corporation
2022-02-22
Updated Description, Extended_Description

CAPEC Content Team
The MITRE Corporation
2023-01-24
Updated Related_Weaknesses, Resources_Required
This pattern of attack sees an adversary load a malicious resource into a program's standard path so that when a known command is executed then the system instead executes the malicious component. The adversary can either modify the search path a program uses, like a PATH variable or classpath, or they can manipulate resources on the path to point to their malicious components. J2EE applications and other component based applications that are built from multiple binaries can have very long list of dependencies to execute. If one of these libraries and/or references is controllable by the attacker then application controls can be circumvented by the attacker.
High
Very High

The attacker must be able to write to redirect search paths on the victim host.

To identify and execute against an over-privileged system interface

Confidentiality
Integrity
Availability
Execute Unauthorized Commands
Run Arbitrary Code

Confidentiality
Access Control
Authorization
Gain Privileges

Design: Enforce principle of least privilege
Design: Ensure that the program's compound parts, including all system dependencies, classpath, path, and so on, are secured to the same or higher level assurance as the program
Implementation: Host integrity monitoring

Another method is to redirect commands by aliasing one legitimate command to another to create unexpected results. the Unix command "rm" could be aliased to "mv" and move all files the victim thinks they are deleting to a directory the attacker controls. In a Unix shell .profile setting
alias rm=mv /usr/home/attacker
In this case the attacker retains a copy of all the files the victim attempts to remove.

A standard UNIX path looks similar to this
/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin
If the attacker modifies the path variable to point to a locale that includes malicious resources then the user unwittingly can execute commands on the attackers' behalf:
/evildir/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin
This is a form of usurping control of the program and the attack can be done on the classpath, database resources, or any other resources built from compound parts. At runtime detection and blocking of this attack is nearly impossible, because the configuration allows execution.

1574.007
Hijack Execution Flow: Path Interception by PATH Environment Variable

1574.009
Hijack Execution Flow: Path Interception by Unquoted Path

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description, Description Summary, Examples-Instances, Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Weaknesses

CAPEC Content Team
The MITRE Corporation
2020-07-30
Updated Taxonomy_Mappings

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Example_Instances, Taxonomy_Mappings
An adversary hosts an event within an application framework and then monitors the data exchanged during the course of the event for the purpose of harvesting any important data leaked during the transactions. One example could be harvesting lists of usernames or userIDs for the purpose of sending spam messages to those users. One example of this type of attack involves the adversary creating an event within the sub-application. Assume the adversary hosts a "virtual sale" of rare items. As other users enter the event, the attacker records via AiTM (CAPEC-94) proxy the user_ids and usernames of everyone who attends. The adversary would then be able to spam those users within the application using an automated script.
Low

The target software is utilizing application framework APIs

Confidentiality
Read Data
The adversary is able to gather information to potentially support further nefarious activities.

Leverage encryption techniques during information transactions so as to protect them from attack patterns of this kind.

1056.004
Input Capture: Credential API Hooking

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Related_Attack_Patterns, Resources_Required, Solutions_and_Mitigations

CAPEC Content Team
The MITRE Corporation
2019-04-04
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2020-12-17
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Description

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Related_Attack_Patterns, Taxonomy_Mappings

Harvesting Usernames or UserIDs via Application API Event Monitoring
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the content of messages. Performing this attack can allow the attacker to gain unauthorized privileges within the application, or conduct attacks such as phishing, deceptive strategies to spread malware, or traditional web-application attacks. The techniques require use of specialized software that allow the attacker to perform adversary-in-the-middle (CAPEC-94) communications between the web browser and the remote system. Despite the use of AiTH software, the attack is actually directed at the server, as the client is one node in a series of content brokers that pass information along to the application framework. Additionally, it is not true "Adversary-in-the-Middle" attack at the network layer, but an application-layer attack the root cause of which is the master applications trust in the integrity of code supplied by the client.
Low

Targeted software is utilizing application framework APIs

A software program that allows a user to man-in-the-middle communications between the client and server, such as a man-in-the-middle proxy.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Abstraction

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Description
An attacker hosts or joins an event or transaction within an application framework in order to change the content of messages or items that are being exchanged. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that look authentic but may contain deceptive links, substitute one item or another, spoof an existing item and conduct a false exchange, or otherwise change the amounts or identity of what is being exchanged. The techniques require use of specialized software that allow the attacker to man-in-the-middle communications between the web browser and the remote system in order to change the content of various application elements. Often, items exchanged in game can be monetized via sales for coin, virtual dollars, etc. The purpose of the attack is for the attack to scam the victim by trapping the data packets involved the exchange and altering the integrity of the transfer process.
Medium

Targeted software is utilizing application framework APIs

A software program that allows the use of adversary-in-the-middle communications (CAPEC-94) between the client and server, such as a man-in-the-middle proxy.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Abstraction

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Resources_Required
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of links/buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains links/buttons that point to an attacker controlled destination. Some applications make navigation remapping more difficult to detect because the actual HREF values of images, profile elements, and links/buttons are masked. One example would be to place an image in a user's photo gallery that when clicked upon redirected the user to an off-site location. Also, traditional web vulnerabilities (such as CSRF) can be constructed with remapped buttons or links. In some cases navigation remapping can be used for Phishing attacks or even means to artificially boost the page view, user site reputation, or click-fraud.
Medium

Targeted software is utilizing application framework APIs

A software program that allows the use of adversary-in-the-middle (CAPEC-94) communications between the client and server, such as a man-in-the-middle proxy.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated Related_Attack_Patterns

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Resources_Required
An adversary manipulates either egress or ingress data from a client within an application framework in order to change the content of messages and thereby circumvent the expected application logic.

Performing this attack allows the adversary to manipulate content in such a way as to produce messages or content that look authentic but may contain deceptive links, spam-like content, or links to the adversarys' code. In general, content-spoofing within an application API can be employed to stage many different types of attacks varied based on the adversarys' intent. When the goal is to spread malware, deceptive content is created such as modified links, buttons, or images, that entice users to click on those items, all of which point to a malicious URI. The techniques require use of specialized software that allow the adversary to use adversary-in-the-middle (CAPEC-94) communications between the web browser and the remote system in order to change the destination of various application interface elements.

Medium

Targeted software is utilizing application framework APIs

A software program that allows the use of adversary-in-the-middle communications between the client and server, such as a man-in-the-middle proxy.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Abstraction

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Description, Resources_Required

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Description, Extended_Description
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains buttons that point to an attacker controlled destination.
Medium

Targeted software is utilizing application framework APIs

A software program that allows the use of adversary-in-the-middle (CAPEC-94) communications between the client and server, such as a adversary-in-the-middle (CAPEC-94) proxy.

An in-game event occurs and the attacker traps the result, which turns out to be a form that will be populated to their primary profile. The attacker, using a MITM proxy, observes the following data:
[Button][Claim_Item]Sourdough_Cookie[URL_IMG]foo[/URL_IMG][Claim_Link]bar[/Claim_Link]
By altering the destination of "Claim_Link" to point to the attackers' server an unwitting victim can be enticed to click the link. Another example would be for the attacker to rewrite the button destinations for an event so that clicking "Yes" or "No" causes the user to load the attackers' code.

CAPEC Content Team
The MITRE Corporation
2014-06-23

CAPEC Content Team
The MITRE Corporation
2018-07-31
Updated Description, Description Summary, Examples-Instances

CAPEC Content Team
The MITRE Corporation
2019-09-30
Updated @Abstraction

CAPEC Content Team
The MITRE Corporation
2021-06-24
Updated Resources_Required

CAPEC Content Team
The MITRE Corporation
2022-09-29
Updated Example_Instances