deardaniel/secdata-raw huggingface dataset:
MITRE CAPEC-206: Signing Malicious Code

Description:
The adversary extracts credentials used for code signing from a production environment and then uses these credentials to sign malicious content with the developer's key. Many developers use signing keys to sign code or hashes of code. When users or applications verify the signatures are accurate they are led to believe that the code came from the owner of the signing key and that the code has not been modified since the signature was applied. If the adversary has extracted the signing credentials then they can use those credentials to sign their own code bundles. Users or tools that verify the signatures attached to the code will likely assume the code came from the legitimate developer and install or run the code, effectively allowing the adversary to execute arbitrary code on the victim's computer. This differs from CAPEC-673, because the adversary is performing the code signing.

Mitigations:
  - Ensure digital certificates are protected and inaccessible by unauthorized uses.
  - If a digital certificate has been compromised it should be revoked and regenerated.
  - Even if a piece of software has a valid and trusted digital signature, it should be assessed for any weaknesses and vulnerabilities.

Related CWEs: 732
MITRE CAPEC-207: Removing Important Client Functionality

Description:
An adversary removes or disables functionality on the client that the server assumes to be present and trustworthy.

Mitigations:
  - Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side.
  - Design: Ship client-side application with integrity checks (code signing) when possible.
  - Design: Use obfuscation and other techniques to prevent reverse engineering the client code.

Related CWEs: 602
MITRE CAPEC-208: Removing/short-circuiting 'Purse' logic: removing/mutating 'cash' decrements

Description:
An attacker removes or modifies the logic on a client associated with monetary calculations resulting in incorrect information being sent to the server. A server may rely on a client to correctly compute monetary information. For example, a server might supply a price for an item and then rely on the client to correctly compute the total cost of a purchase given the number of items the user is buying. If the attacker can remove or modify the logic that controls these calculations, they can return incorrect values to the server. The attacker can use this to make purchases for a fraction of the legitimate cost or otherwise avoid correct billing for activities.

Related CWEs: 602
MITRE CAPEC-209: XSS Using MIME Type Mismatch

Description:
An adversary creates a file with scripting content but where the specified MIME type of the file is such that scripting is not expected. The adversary tricks the victim into accessing a URL that responds with the script file. Some browsers will detect that the specified MIME type of the file does not match the actual type of its content and will automatically switch to using an interpreter for the real content type. If the browser does not invoke script filters before doing this, the adversary's script may run on the target unsanitized, possibly revealing the victim's cookies or executing arbitrary script in their browser.

Related CWEs: 79, 20, 646
MITRE CAPEC-21: Exploitation of Trusted Identifiers

Description:
An adversary guesses, obtains, or "rides" a trusted identifier (e.g. session ID, resource ID, cookie, etc.) to perform authorized actions under the guise of an authenticated user or service.

Mitigations:
  - Design: utilize strong federated identity such as SAML to encrypt and sign identity tokens in transit.
  - Implementation: Use industry standards session key generation mechanisms that utilize high amount of entropy to generate the session key. Many standard web and application servers will perform this ta
  - Implementation: If the identifier is used for authentication, such as in the so-called single sign on use cases, then ensure that it is protected at the same level of assurance as authentication token

Related CWEs: 290, 302, 346, 539, 6, 384, 664, 602, 642
MITRE CAPEC-212: Functionality Misuse

Description:
An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact. The system functionality is not altered or modified but used in a way that was not intended. This is often accomplished through the overuse of a specific functionality or by leveraging functionality with design flaws that enables the adversary to gain access to unauthorized, sensitive data.

Mitigations:
  - Perform comprehensive threat modeling, a process of identifying, evaluating, and mitigating potential threats to the application. This effort can help reveal potentially obscure application functional
  - When implementing security features, consider how they can be misused and compromised.

Related CWEs: 1242, 1246, 1281
MITRE CAPEC-215: Fuzzing for application mapping

Description:
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.

Mitigations:
  - Design: Construct a 'code book' for error messages. When using a code book, application error messages aren't generated in string or stack trace form, but are catalogued and replaced with a unique (of
  - Design: wrap application functionality (preferably through the underlying framework) in an output encoding scheme that obscures or cleanses error messages to prevent such attacks. Such a technique is 
  - Implementation: Obfuscate server fields of HTTP response.

Related CWEs: 209, 532
MITRE CAPEC-216: Communication Channel Manipulation

Description:
An adversary manipulates a setting or parameter on communications channel in order to compromise its security. This can result in information exposure, insertion/removal of information from the communications stream, and/or potentially system compromise.

Mitigations:
  - Encrypt all sensitive communications using properly-configured cryptography.
  - Design the communication system such that it associates proper authentication/authorization with each channel/message.

Related CWEs: 306
MITRE CAPEC-217: Exploiting Incorrectly Configured SSL/TLS

Description:
An adversary takes advantage of incorrectly configured SSL/TLS communications that enables access to data intended to be encrypted. The adversary may also use this type of attack to inject commands or other traffic into the encrypted stream to cause compromise of either the client or server.

Mitigations:
  - Do not use SSL, as all SSL versions have been broken and should not be used. If TLS is not an option for the client or server, consider setting timeouts on SSL sessions to extremely low values to less
  - Only use TLS version 1.2+, as versions 1.0 and 1.1 are insecure.
  - Configure TLS to use secure algorithms. The current recommendation is to use ECDH, ECDSA, AES256-GCM, and SHA384 for the most security.

Related CWEs: 201
MITRE CAPEC-218: Spoofing of UDDI/ebXML Messages

Description:
An attacker spoofs a UDDI, ebXML, or similar message in order to impersonate a service provider in an e-business transaction. UDDI, ebXML, and similar standards are used to identify businesses in e-business transactions. Among other things, they identify a particular participant, WSDL information for SOAP transactions, and supported communication protocols, including security protocols. By spoofing one of these messages an attacker could impersonate a legitimate business in a transaction or could manipulate the protocols used between a client and business. This could result in disclosure of sensitive information, loss of message integrity, or even financial fraud.

Mitigations:
  - Implementation: Clients should only trust UDDI, ebXML, or similar messages that are verifiably signed by a trusted party.

Related CWEs: 345
MITRE CAPEC-219: XML Routing Detour Attacks

Description:
An attacker subverts an intermediate system used to process XML content and forces the intermediate to modify and/or re-route the processing of the content. XML Routing Detour Attacks are Adversary in the Middle type attacks (CAPEC-94). The attacker compromises or inserts an intermediate system in the processing of the XML message. For example, WS-Routing can be used to specify a series of nodes or intermediaries through which content is passed. If any of the intermediate nodes in this route are compromised by an attacker they could be used for a routing detour attack. From the compromised system the attacker is able to route the XML process to other nodes of their choice and modify the responses so that the normal chain of processing is unaware of the interception. This system can forward the message to an outside entity and hide the forwarding and processing from the legitimate processing systems by altering the header information.

Mitigations:
  - Design: Specify maximum number intermediate nodes for the request and require SSL connections with mutual authentication.
  - Implementation: Use SSL for connections between all parties with mutual authentication.

Related CWEs: 441, 610
MITRE CAPEC-22: Exploiting Trust in Client

Description:
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.

Mitigations:
  - Design: Ensure that client process and/or message is authenticated so that anonymous communications and/or messages are not accepted by the system.
  - Design: Do not rely on client validation or encoding for security purposes.
  - Design: Utilize digital signatures to increase authentication assurance.

Related CWEs: 290, 287, 20, 200, 693
MITRE CAPEC-220: Client-Server Protocol Manipulation

Description:
An adversary takes advantage of weaknesses in the protocol by which a client and server are communicating to perform unexpected actions. Communication protocols are necessary to transfer messages between client and server applications. Moreover, different protocols may be used for different types of interactions.

Related CWEs: 757
MITRE CAPEC-221: Data Serialization External Entities Blowup

Description:
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.

Mitigations:
  - This attack may be mitigated by tweaking the XML parser to not resolve external entities. If external entities are needed, then implement a custom XmlResolver that has a request timeout, data retrieva
  - This attack may be mitigated by tweaking the serialized data parser to not resolve external entities. If external entities are needed, then implement a custom resolver that has a request timeout, data

Related CWEs: 611
MITRE CAPEC-222: iFrame Overlay

Description:
In an iFrame overlay attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from seemingly completely different system.

Mitigations:
  - Configuration: Disable iFrames in the Web browser.
  - Operation: When maintaining an authenticated session with a privileged target system, do not use the same browser to navigate to unfamiliar sites to perform other activities. Finish working with the t
  - Operation: If using the Firefox browser, use the NoScript plug-in that will help forbid iFrames.

Related CWEs: 1021
MITRE CAPEC-224: Fingerprinting

Description:
An adversary compares output from a target system to known indicators that uniquely identify specific details about the target. Most commonly, fingerprinting is done to determine operating system and application versions. Fingerprinting can be done passively as well as actively. Fingerprinting by itself is not usually detrimental to the target. However, the information gathered through fingerprinting often enables an adversary to discover existing weaknesses in the target.

Mitigations:
  - While some information is shared by systems automatically based on standards and protocols, remove potentially sensitive information that is not necessary for the application's functionality as much a

Related CWEs: 200
MITRE CAPEC-226: Session Credential Falsification through Manipulation

Description:
An attacker manipulates an existing credential in order to gain access to a target application. Session credentials allow users to identify themselves to a service after an initial authentication without needing to resend the authentication information (usually a username and password) with every message. An attacker may be able to manipulate a credential sniffed from an existing connection in order to gain access to a target server.

Related CWEs: 565, 472
MITRE CAPEC-227: Sustained Client Engagement

Description:
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.

Mitigations:
  - Potential mitigations include requiring a unique login for each resource request, constraining local unprivileged access by disallowing simultaneous engagements of the resource, or limiting access to 

Related CWEs: 400
MITRE CAPEC-228: DTD Injection

Description:
An attacker injects malicious content into an application's DTD in an attempt to produce a negative technical impact. DTDs are used to describe how XML documents are processed. Certain malformed DTDs (for example, those with excessive entity expansion as described in CAPEC 197) can cause the XML parsers that process the DTDs to consume excessive resources resulting in resource depletion.

Mitigations:
  - Design: Sanitize incoming DTDs to prevent excessive expansion or other actions that could result in impacts like resource depletion.
  - Implementation: Disallow the inclusion of DTDs as part of incoming messages.
  - Implementation: Use XML parsing tools that protect against DTD attacks.

Related CWEs: 829
MITRE CAPEC-229: Serialized Data Parameter Blowup

Description:
This attack exploits certain serialized data parsers (e.g., XML, YAML, etc.) which manage data in an inefficient manner. The attacker crafts an serialized data file with multiple configuration parameters in the same dataset. In a vulnerable parser, this results in a denial of service condition where CPU resources are exhausted because of the parsing algorithm. The weakness being exploited is tied to parser implementation and not language specific.

Mitigations:
  - This attack may be mitigated completely by using a parser that is not using a vulnerable container.
  - Mitigation may limit the number of configuration parameters per dataset.

Related CWEs: 770
MITRE CAPEC-23: File Content Injection

Description:
An adversary poisons files with a malicious payload (targeting the file systems accessible by the target software), which may be passed through by standard channels such as via email, and standard web content like PDF and multimedia files. The adversary exploits known vulnerabilities or handling routines in the target processes, in order to exploit the host's trust in executing remote content, including binary files.

Mitigations:
  - Design: Enforce principle of least privilege
  - Design: Validate all input for content including files. Ensure that if files and remote content must be accepted that once accepted, they are placed in a sandbox type location so that lower assurance 
  - Design: Execute programs with constrained privileges, so parent process does not open up further vulnerabilities. Ensure that all directories, temporary directories and files, and memory are executing

Related CWEs: 20
MITRE CAPEC-230: Serialized Data with Nested Payloads

Description:
Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization.

Mitigations:
  - Carefully validate and sanitize all user-controllable data prior to passing it to the data parser routine. Ensure that the resultant data is safe to pass to the data parser.
  - Perform validation on canonical data.
  - Pick a robust implementation of the data parser.

Related CWEs: 112, 20, 674, 770
MITRE CAPEC-231: Oversized Serialized Data Payloads

Description:
An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.

Mitigations:
  - Carefully validate and sanitize all user-controllable serialized data prior to passing it to the parser routine. Ensure that the resultant data is safe to pass to the parser.
  - Perform validation on canonical data.
  - Pick a robust implementation of the serialized data parser.

Related CWEs: 112, 20, 674, 770
MITRE CAPEC-233: Privilege Escalation

Description:
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.

Related CWEs: 269, 1264, 1311
MITRE CAPEC-234: Hijacking a privileged process

Description:
An adversary gains control of a process that is assigned elevated privileges in order to execute arbitrary code with those privileges. Some processes are assigned elevated privileges on an operating system, usually through association with a particular user, group, or role. If an attacker can hijack this process, they will be able to assume its level of privilege in order to execute their own code.

Related CWEs: 732, 648
MITRE CAPEC-237: Escaping a Sandbox by Calling Code in Another Language

Description:
The attacker may submit malicious code of another language to obtain access to privileges that were not intentionally exposed by the sandbox, thus escaping the sandbox. For instance, Java code cannot perform unsafe operations, such as modifying arbitrary memory locations, due to restrictions placed on it by the Byte code Verifier and the JVM. If allowed, Java code can call directly into native C code, which may perform unsafe operations, such as call system calls and modify arbitrary memory locations on their behalf. To provide isolation, Java does not grant untrusted code with unmediated access to native C code. Instead, the sandboxed code is typically allowed to call some subset of the pre-existing native code that is part of standard libraries.

Mitigations:
  - Assurance: Sanitize the code of the standard libraries to make sure there is no security weaknesses in them.
  - Design: Use obfuscation and other techniques to prevent reverse engineering the standard libraries.
  - Assurance: Use static analysis tool to do code review and dynamic tool to do penetration test on the standard library.

Related CWEs: 693
MITRE CAPEC-24: Filter Failure through Buffer Overflow

Description:
In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).

Mitigations:
  - Make sure that ANY failure occurring in the filtering or input validation routine is properly handled and that offending input is NOT allowed to go through. Basically make sure that the vault is close
  - Pre-design: Use a language or compiler that performs automatic bounds checking.
  - Pre-design through Build: Compiler-based canary mechanisms such as StackGuard, ProPolice and the Microsoft Visual Studio /GS flag. Unless this provides automatic bounds checking, it is not a complete 

Related CWEs: 120, 119, 118, 74, 20, 680, 733, 697
MITRE CAPEC-240: Resource Injection

Description:
An adversary exploits weaknesses in input validation by manipulating resource identifiers enabling the unintended modification or specification of a resource.

Mitigations:
  - Ensure all input content that is delivered to client is sanitized against an acceptable content specification.
  - Perform input validation for all content.
  - Enforce regular patching of software.

Related CWEs: 99
MITRE CAPEC-242: Code Injection

Description:
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.

Mitigations:
  - Utilize strict type, character, and encoding enforcement
  - Ensure all input content that is delivered to client is sanitized against an acceptable content specification.
  - Perform input validation for all content.

Related CWEs: 94
MITRE CAPEC-243: XSS Targeting HTML Attributes

Description:
An adversary inserts commands to perform cross-site scripting (XSS) actions in HTML attributes. Many filters do not adequately sanitize attributes against the presence of potentially dangerous commands even if they adequately sanitize tags. For example, dangerous expressions could be inserted into a style attribute in an anchor tag, resulting in the execution of malicious code when the resulting page is rendered. If a victim is tricked into viewing the rendered page the attack proceeds like a normal XSS attack, possibly resulting in the loss of sensitive cookies or other malicious activities.

Mitigations:
  - Design: Use libraries and templates that minimize unfiltered input.
  - Implementation: Normalize, filter and use an allowlist for all input including that which is not expected to have any scripting content.
  - Implementation: The victim should configure the browser to minimize active content from untrusted sources.

Related CWEs: 83