deardaniel/secdata-raw huggingface dataset:
MITRE CAPEC-120: Double Encoding

Description:
The adversary utilizes a repeating of the encoding process for a set of characters (that is, character encoding a character encoding of a character) to obfuscate the payload of a particular request. This may allow the adversary to bypass filters that attempt to detect illegal characters or strings, such as those that might be used in traversal or injection attacks. Filters may be able to catch illegal encoded strings, but may not catch doubly encoded strings. For example, a dot (.), often used in path traversal attacks and therefore often blocked by filters, could be URL encoded as %2E. However, many filters recognize this encoding and would still block the request. In a double encoding, the % in the above URL encoding would be encoded again as %25, resulting in %252E which some filters might not catch, but which could still be interpreted as a dot (.) by interpreters on the target.

Mitigations:
  - Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should 
  - Be aware of the threat of alternative method of data encoding and obfuscation technique such as IP address encoding.
  - When client input is required from web-based forms, avoid using the "GET" method to submit data, as the method causes the form data to be appended to the URL and is easily manipulated. Instead, use th

Related CWEs: 173, 172, 177, 181, 183, 184, 74, 20, 697, 692
MITRE CAPEC-121: Exploit Non-Production Interfaces

Description:
An adversary exploits a sample, demonstration, test, or debug interface that is unintentionally enabled on a production system, with the goal of gleaning information or leveraging functionality that would otherwise be unavailable.

Mitigations:
  - Ensure that production systems do not contain non-production interfaces and that these interfaces are only used in development environments.

Related CWEs: 489, 1209, 1259, 1267, 1270, 1294, 1295, 1296, 1302, 1313
MITRE CAPEC-122: Privilege Abuse

Description:
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.

Mitigations:
  - Configure account privileges such privileged/administrator functionality is not exposed to non-privileged/lower accounts.

Related CWEs: 269, 732, 1317
MITRE CAPEC-123: Buffer Manipulation

Description:
An adversary manipulates an application's interaction with a buffer in an attempt to read or modify data they shouldn't have access to. Buffer attacks are distinguished in that it is the buffer space itself that is the target of the attack rather than any code responsible for interpreting the content of the buffer. In virtually all buffer attacks the content that is placed in the buffer is immaterial. Instead, most buffer attacks involve retrieving or providing more input than can be stored in the allocated buffer, resulting in the reading or overwriting of other unintended program memory.

Mitigations:
  - To help protect an application from buffer manipulation attacks, a number of potential mitigations can be leveraged. Before starting the development of the application, consider using a code language 

Related CWEs: 119
MITRE CAPEC-124: Shared Resource Manipulation

Description:
An adversary exploits a resource shared between multiple applications, an application pool or hardware pin multiplexing to affect behavior. Resources may be shared between multiple applications or between multiple threads of a single application. Resource sharing is usually accomplished through mutual access to a single memory location or multiplexed hardware pins. If an adversary can manipulate this shared resource (usually by co-opting one of the applications or threads) the other applications or threads using the shared resource will often continue to trust the validity of the compromised shared resource and use it in their calculations. This can result in invalid trust assumptions, corruption of additional data through the normal operations of the other users of the shared resource, or even cause a crash or compromise of the sharing applications.

Related CWEs: 1189, 1331
MITRE CAPEC-125: Flooding

Description:
An adversary consumes the resources of a target by rapidly engaging in a large number of interactions with the target. This type of attack generally exposes a weakness in rate limiting or flow. When successful this attack prevents legitimate users from accessing the service and can cause the target to crash. This attack differs from resource depletion through leaks or allocations in that the latter attacks do not rely on the volume of requests made to the target but instead focus on manipulation of the target's operations. The key factor in a flooding attack is the number of requests the adversary can make in a given period of time. The greater this number, the more likely an attack is to succeed against a given target.

Mitigations:
  - Ensure that protocols have specific limits of scale configured.
  - Specify expectations for capabilities and dictate which behaviors are acceptable when resource allocation reaches limits.
  - Uniformly throttle all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

Related CWEs: 404, 770
MITRE CAPEC-126: Path Traversal

Description:
An adversary uses path manipulation methods to exploit insufficient input validation of a target to obtain access to data that should be not be retrievable by ordinary well-formed requests. A typical variety of this attack involves specifying a path to a desired file together with dot-dot-slash characters, resulting in the file access API or function traversing out of the intended directory structure and into the root file system. By replacing or modifying the expected path information the access function or API retrieves the file desired by the attacker. These attacks either involve the attacker providing a complete path to a targeted file or using control characters (e.g. path separators (/ or \) and/or dots (.)) to reach desired directories or files.

Mitigations:
  - Design: Configure the access control correctly.
  - Design: Enforce principle of least privilege.
  - Design: Execute programs with constrained privileges, so parent process does not open up further vulnerabilities. Ensure that all directories, temporary directories and files, and memory are executing

Related CWEs: 22
MITRE CAPEC-127: Directory Indexing

Description:
An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.

Mitigations:
  - 1. Using blank index.html: putting blank index.html simply prevent directory listings from displaying to site visitors.
  - 2. Preventing with .htaccess in Apache web server: In .htaccess, write "Options-indexes".
  - 3. Suppressing error messages: using error 403 "Forbidden" message exactly like error 404 "Not Found" message.

Related CWEs: 424, 425, 288, 285, 732, 276, 693
MITRE CAPEC-128: Integer Attacks

Description:
An attacker takes advantage of the structure of integer variables to cause these variables to assume values that are not expected by an application. For example, adding one to the largest positive integer in a signed integer variable results in a negative number. Negative numbers may be illegal in an application and the application may prevent an attacker from providing them directly, but the application may not consider that adding two positive numbers can create a negative number do to the structure of integer storage formats.

Related CWEs: 682
MITRE CAPEC-129: Pointer Manipulation

Description:
This attack pattern involves an adversary manipulating a pointer within a target application resulting in the application accessing an unintended memory location. This can result in the crashing of the application or, for certain pointer values, access to data that would not normally be possible or the execution of arbitrary code. Since pointers are simply integer variables, Integer Attacks may often be used in Pointer Attacks.

Related CWEs: 682, 822, 823
MITRE CAPEC-13: Subverting Environment Variable Values

Description:
The adversary directly or indirectly modifies environment variables used by or controlling the target software. The adversary's goal is to cause the target software to deviate from its expected operation in a manner that benefits the adversary.

Mitigations:
  - Protect environment variables against unauthorized read and write access.
  - Protect the configuration files which contain environment variables against illegitimate read and write access.
  - Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should 

Related CWEs: 353, 285, 302, 74, 15, 73, 20, 200
MITRE CAPEC-130: Excessive Allocation

Description:
An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources. This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.

Mitigations:
  - Limit the amount of resources that are accessible to unprivileged users.
  - Assume all input is malicious. Consider all potentially relevant properties when validating input.
  - Consider uniformly throttling all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

Related CWEs: 404, 770, 1325
MITRE CAPEC-131: Resource Leak Exposure

Description:
An adversary utilizes a resource leak on the target to deplete the quantity of the resource available to service legitimate requests.

Mitigations:
  - If possible, leverage coding language(s) that do not allow this weakness to occur (e.g., Java, Ruby, and Python all perform automatic garbage collection that releases memory for objects that have been
  - Memory should always be allocated/freed using matching functions (e.g., malloc/free, new/delete, etc.)
  - Implement best practices with respect to memory management, including the freeing of all allocated resources at all exit points and ensuring consistency with how and where memory is freed in a functio

Related CWEs: 404
MITRE CAPEC-132: Symlink Attack

Description:
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.

Mitigations:
  - Design: Check for the existence of files to be created, if in existence verify they are neither symlinks nor hard links before opening them.
  - Implementation: Use randomly generated file names for temporary files. Give the files restrictive permissions.

Related CWEs: 59
MITRE CAPEC-133: Try All Common Switches

Description:
An attacker attempts to invoke all common switches and options in the target application for the purpose of discovering weaknesses in the target. For example, in some applications, adding a --debug switch causes debugging information to be displayed, which can sometimes reveal sensitive processing or configuration information to an attacker. This attack differs from other forms of API abuse in that the attacker is indiscriminately attempting to invoke options in the hope that one of them will work rather than specifically targeting a known option. Nonetheless, even if the attacker is familiar with the published options of a targeted application this attack method may still be fruitful as it might discover unpublicized functionality.

Mitigations:
  - Design: Minimize switch and option functionality to only that necessary for correct function of the command.
  - Implementation: Remove all debug and testing options from production code.

Related CWEs: 912
MITRE CAPEC-134: Email Injection

Description:
An adversary manipulates the headers and content of an email message by injecting data via the use of delimiter characters native to the protocol.

Related CWEs: 150
MITRE CAPEC-135: Format String Injection

Description:
An adversary includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the memory. An adversary can use this to read or write to memory locations or files, or simply to manipulate the value of the resulting text in unexpected ways. Reading or writing memory may result in program crashes and writing memory could result in the execution of arbitrary code if the adversary can write to the program stack.

Mitigations:
  - Limit the usage of formatting string functions.
  - Strong input validation - All user-controllable input must be validated and filtered for illegal formatting characters.

Related CWEs: 134, 20, 74
MITRE CAPEC-136: LDAP Injection

Description:
An attacker manipulates or crafts an LDAP query for the purpose of undermining the security of the target. Some applications use user input to create LDAP queries that are processed by an LDAP server. For example, a user might provide their username during authentication and the username might be inserted in an LDAP query during the authentication process. An attacker could use this input to inject additional commands into an LDAP query that could disclose sensitive information. For example, entering a * in the aforementioned query might return information about all users on the system. This attack is very similar to an SQL injection attack in that it manipulates a query to gather additional information or coerce a particular return value.

Mitigations:
  - Strong input validation - All user-controllable input must be validated and filtered for illegal characters as well as LDAP content.
  - Use of custom error pages - Attackers can glean information about the nature of queries from descriptive error messages. Input validation must be coupled with customized error pages that inform about 

Related CWEs: 77, 90, 20
MITRE CAPEC-137: Parameter Injection

Description:
An adversary manipulates the content of request parameters for the purpose of undermining the security of the target. Some parameter encodings use text characters as separators. For example, parameters in a HTTP GET message are encoded as name-value pairs separated by an ampersand (&). If an attacker can supply text strings that are used to fill in these parameters, then they can inject special characters used in the encoding scheme to add or modify parameters. For example, if user input is fed directly into an HTTP GET request and the user provides the value "myInput&new_param=myValue", then the input parameter is set to myInput, but a new parameter (new_param) is also added with a value of myValue. This can significantly change the meaning of the query that is processed by the server. Any encoding scheme where parameters are identified and separated by text characters is potentially vulnerable to this attack - the HTTP GET encoding used above is just one example.

Mitigations:
  - Implement an audit log written to a separate host. In the event of a compromise, the audit log may be able to provide evidence and details of the compromise.
  - Treat all user input as untrusted data that must be validated before use.

Related CWEs: 88
MITRE CAPEC-138: Reflection Injection

Description:
An adversary supplies a value to the target application which is then used by reflection methods to identify a class, method, or field. For example, in the Java programming language the reflection libraries permit an application to inspect, load, and invoke classes and their components by name. If an adversary can control the input into these methods including the name of the class/method/field or the parameters passed to methods, they can cause the targeted application to invoke incorrect methods, read random fields, or even to load and utilize malicious classes that the adversary created. This can lead to the application revealing sensitive information, returning incorrect results, or even having the adversary take control of the targeted application.

Related CWEs: 470
MITRE CAPEC-139: Relative Path Traversal

Description:
An attacker exploits a weakness in input validation on the target by supplying a specially constructed path utilizing dot and slash characters for the purpose of obtaining access to arbitrary files or resources. An attacker modifies a known path on the target in order to reach material that is not available through intended channels. These attacks normally involve adding additional path separators (/ or \) and/or dots (.), or encodings thereof, in various combinations in order to reach parent directories or entirely separate trees of the target's directory structure.

Mitigations:
  - Design: Input validation. Assume that user inputs are malicious. Utilize strict type, character, and encoding enforcement
  - Implementation: Perform input validation for all remote content, including remote and user-generated content.
  - Implementation: Validate user input by only accepting known good. Ensure all content that is delivered to client is sanitized against an acceptable content specification -- using an allowlist approach

Related CWEs: 23
MITRE CAPEC-14: Client-side Injection-induced Buffer Overflow

Description:
This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service. This hostile service is created to deliver the correct content to the client software. For example, if the client-side application is a browser, the service will host a webpage that the browser loads.

Mitigations:
  - The client software should not install untrusted code from a non-authenticated server.
  - The client software should have the latest patches and should be audited for vulnerabilities before being used to communicate with potentially hostile servers.
  - Perform input validation for length of buffer inputs.

Related CWEs: 120, 353, 118, 119, 74, 20, 680, 697
MITRE CAPEC-140: Bypassing of Intermediate Forms in Multiple-Form Sets

Description:
Some web applications require users to submit information through an ordered sequence of web forms. This is often done if there is a very large amount of information being collected or if information on earlier forms is used to pre-populate fields or determine which additional information the application needs to collect. An attacker who knows the names of the various forms in the sequence may be able to explicitly type in the name of a later form and navigate to it without first going through the previous forms. This can result in incomplete collection of information, incorrect assumptions about the information submitted by the attacker, or other problems that can impair the functioning of the application.

Related CWEs: 372
MITRE CAPEC-141: Cache Poisoning

Description:
An attacker exploits the functionality of cache technologies to cause specific data to be cached that aids the attackers' objectives. This describes any attack whereby an attacker places incorrect or harmful material in cache. The targeted cache can be an application's cache (e.g. a web browser cache) or a public cache (e.g. a DNS or ARP cache). Until the cache is refreshed, most applications or clients will treat the corrupted cache value as valid. This can lead to a wide range of exploits including redirecting web browsers towards sites that install malware and repeatedly incorrect calculations based on the incorrect value.

Mitigations:
  - Configuration: Disable client side caching.
  - Implementation: Listens for query replies on a network, and sends a notification via email when an entry changes.

Related CWEs: 348, 345, 349, 346
MITRE CAPEC-142: DNS Cache Poisoning

Description:
A domain name server translates a domain name (such as www.example.com) into an IP address that Internet hosts use to contact Internet resources. An adversary modifies a public DNS cache to cause certain names to resolve to incorrect addresses that the adversary specifies. The result is that client applications that rely upon the targeted cache for domain name resolution will be directed not to the actual address of the specified domain name but to some other address. Adversaries can use this to herd clients to sites that install malware on the victim's computer or to masquerade as part of a Pharming attack.

Mitigations:
  - Configuration: Make sure your DNS servers have been updated to the latest versions
  - Configuration: UNIX services like rlogin, rsh/rcp, xhost, and nfs are all susceptible to wrong information being held in a cache. Care should be taken with these services so they do not rely upon DNS 
  - Configuration: Disable client side DNS caching.

Related CWEs: 348, 345, 349, 346, 350
MITRE CAPEC-143: Detect Unpublicized Web Pages

Description:
An adversary searches a targeted web site for web pages that have not been publicized. In doing this, the adversary may be able to gain access to information that the targeted site did not intend to make public.

Related CWEs: 425
MITRE CAPEC-144: Detect Unpublicized Web Services

Description:
An adversary searches a targeted web site for web services that have not been publicized. This attack can be especially dangerous since unpublished but available services may not have adequate security controls placed upon them given that an administrator may believe they are unreachable.

Related CWEs: 425
MITRE CAPEC-145: Checksum Spoofing

Description:
An adversary spoofs a checksum message for the purpose of making a payload appear to have a valid corresponding checksum. Checksums are used to verify message integrity. They consist of some value based on the value of the message they are protecting. Hash codes are a common checksum mechanism. Both the sender and recipient are able to compute the checksum based on the contents of the message. If the message contents change between the sender and recipient, the sender and recipient will compute different checksum values. Since the sender's checksum value is transmitted with the message, the recipient would know that a modification occurred. In checksum spoofing an adversary modifies the message body and then modifies the corresponding checksum so that the recipient's checksum calculation will match the checksum (created by the adversary) in the message. This would prevent the recipient from realizing that a change occurred.

Related CWEs: 354