deardaniel/secdata-raw huggingface dataset:
MITRE CAPEC-592: Stored XSS

Description:
An adversary utilizes a form of Cross-site Scripting (XSS) where a malicious script is persistently "stored" within the data storage of a vulnerable web application as valid input.

Mitigations:
  - Use browser technologies that do not allow client-side scripting.
  - Utilize strict type, character, and encoding enforcement.
  - Ensure that all user-supplied input is validated before being stored.

Related CWEs: 79
MITRE CAPEC-593: Session Hijacking

Description:
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.

Mitigations:
  - Properly encrypt and sign identity tokens in transit, and use industry standard session key generation mechanisms that utilize high amount of entropy to generate the session key. Many standard web and

Related CWEs: 287
MITRE CAPEC-594: Traffic Injection

Description:
An adversary injects traffic into the target's network connection. The adversary is therefore able to degrade or disrupt the connection, and potentially modify the content. This is not a flooding attack, as the adversary is not focusing on exhausting resources. Instead, the adversary is crafting a specific input to affect the system in a particular way.

Related CWEs: 940
MITRE CAPEC-595: Connection Reset

Description:
In this attack pattern, an adversary injects a connection reset packet to one or both ends of a target's connection. The attacker is therefore able to have the target and/or the destination server sever the connection without having to directly filter the traffic between them.

Related CWEs: 940
MITRE CAPEC-596: TCP RST Injection

Description:
An adversary injects one or more TCP RST packets to a target after the target has made a HTTP GET request. The goal of this attack is to have the target and/or destination web server terminate the TCP connection.

Related CWEs: 940
MITRE CAPEC-597: Absolute Path Traversal

Description:
An adversary with access to file system resources, either directly or via application logic, will use various file absolute paths and navigation mechanisms such as ".." to extend their range of access to inappropriate areas of the file system. The goal of the adversary is to access directories and files that are intended to be restricted from their access.

Mitigations:
  - Design: Configure the access control correctly.
  - Design: Enforce principle of least privilege.
  - Design: Execute programs with constrained privileges, so parent process does not open up further vulnerabilities. Ensure that all directories, temporary directories and files, and memory are executing

Related CWEs: 36
MITRE CAPEC-598: DNS Spoofing

Description:
An adversary sends a malicious ("NXDOMAIN" ("No such domain") code, or DNS A record) response to a target's route request before a legitimate resolver can. This technique requires an On-path or In-path device that can monitor and respond to the target's DNS requests. This attack differs from BGP Tampering in that it directly responds to requests made by the target instead of polluting the routing the target's infrastructure uses.

Mitigations:
  - Design: Avoid dependence on DNS
  - Design: Include "hosts file"/IP address in the application
  - Implementation: Utilize a .onion domain with Tor support
MITRE CAPEC-599: Terrestrial Jamming

Description:
In this attack pattern, the adversary transmits disruptive signals in the direction of the target's consumer-level satellite dish (as opposed to the satellite itself). The transmission disruption occurs in a more targeted range. Portable terrestrial jammers have a range of 3-5 kilometers in urban areas and 20 kilometers in rural areas. This technique requires a terrestrial jammer that is more powerful than the frequencies sent from the satellite.
MITRE CAPEC-6: Argument Injection

Description:
An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.

Mitigations:
  - Design: Do not program input values directly on command shell, instead treat user input as guilty until proven innocent. Build a function that takes user input and converts it to applications specific
  - Design: Limit program privileges, so if metacharacters or other methods circumvent program input validation routines and shell access is attained then it is not running under a privileged account. chr
  - Implementation: Implement an audit log that is written to a separate host, in the event of a compromise the audit log may be able to provide evidence and details of the compromise.

Related CWEs: 74, 146, 184, 78, 185, 697
MITRE CAPEC-60: Reusing Session IDs (aka Session Replay)

Description:
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.

Mitigations:
  - Always invalidate a session ID after the user logout.
  - Setup a session time out for the session IDs.
  - Protect the communication between the client and server. For instance it is best practice to use SSL to mitigate adversary in the middle attacks (CAPEC-94).

Related CWEs: 294, 290, 346, 384, 488, 539, 200, 285, 664, 732
MITRE CAPEC-600: Credential Stuffing

Description:
An adversary tries known username/password combinations against different systems, applications, or services to gain additional authenticated access. Credential Stuffing attacks rely upon the fact that many users leverage the same username/password combination for multiple systems, applications, and services.

Mitigations:
  - Leverage multi-factor authentication for all authentication services and prior to granting an entity access to the domain network.
  - Create a strong password policy and ensure that your system enforces this policy.
  - Ensure users are not reusing username/password combinations for multiple systems, applications, or services.

Related CWEs: 522, 307, 308, 309, 262, 263, 654
MITRE CAPEC-601: Jamming

Description:
An adversary uses radio noise or signals in an attempt to disrupt communications. By intentionally overwhelming system resources with illegitimate traffic, service is denied to the legitimate traffic of authorized users.
MITRE CAPEC-603: Blockage

Description:
An adversary blocks the delivery of an important system resource causing the system to fail or stop working.
MITRE CAPEC-604: Wi-Fi Jamming

Description:
In this attack scenario, the attacker actively transmits on the Wi-Fi channel to prevent users from transmitting or receiving data from the targeted Wi-Fi network. There are several known techniques to perform this attack – for example: the attacker may flood the Wi-Fi access point (e.g. the retransmission device) with deauthentication frames. Another method is to transmit high levels of noise on the RF band used by the Wi-Fi network.

Mitigations:
  - Countermeasures have been proposed for both disassociation flooding and RF jamming, however these countermeasures are not standardized and would need to be supported on both the retransmission device
MITRE CAPEC-605: Cellular Jamming

Description:
In this attack scenario, the attacker actively transmits signals to overpower and disrupt the communication between a cellular user device and a cell tower. Several existing techniques are known in the open literature for this attack for 2G, 3G, and 4G LTE cellular technology. For example, some attacks target cell towers by overwhelming them with false status messages, while others introduce high levels of noise on signaling channels.

Mitigations:
  - Mitigating this attack requires countermeasures employed on both the retransmission device as well as on the cell tower. Therefore, any system that relies on existing commercial cell towards will like
MITRE CAPEC-606: Weakening of Cellular Encryption

Description:
An attacker, with control of a Cellular Rogue Base Station or through cooperation with a Malicious Mobile Network Operator can force the mobile device (e.g., the retransmission device) to use no encryption (A5/0 mode) or to use easily breakable encryption (A5/1 or A5/2 mode).

Mitigations:
  - Use of hardened baseband firmware on retransmission device to detect and prevent the use of weak cellular encryption.
  - Monitor cellular RF interface to detect the usage of weaker-than-expected cellular encryption.

Related CWEs: 757
MITRE CAPEC-607: Obstruction

Description:
An attacker obstructs the interactions between system components. By interrupting or disabling these interactions, an adversary can often force the system into a degraded state or cause the system to stop working as intended. This can cause the system components to be unavailable until the obstruction mitigated.
MITRE CAPEC-608: Cryptanalysis of Cellular Encryption

Description:
The use of cryptanalytic techniques to derive cryptographic keys or otherwise effectively defeat cellular encryption to reveal traffic content. Some cellular encryption algorithms such as A5/1 and A5/2 (specified for GSM use) are known to be vulnerable to such attacks and commercial tools are available to execute these attacks and decrypt mobile phone conversations in real-time. Newer encryption algorithms in use by UMTS and LTE are stronger and currently believed to be less vulnerable to these types of attacks. Note, however, that an attacker with a Cellular Rogue Base Station can force the use of weak cellular encryption even by newer mobile devices.

Mitigations:
  - Use of hardened baseband firmware on retransmission device to detect and prevent the use of weak cellular encryption.
  - Monitor cellular RF interface to detect the usage of weaker-than-expected cellular encryption.

Related CWEs: 327
MITRE CAPEC-609: Cellular Traffic Intercept

Description:
Cellular traffic for voice and data from mobile devices and retransmission devices can be intercepted via numerous methods. Malicious actors can deploy their own cellular tower equipment and intercept cellular traffic surreptitiously. Additionally, government agencies of adversaries and malicious actors can intercept cellular traffic via the telecommunications backbone over which mobile traffic is transmitted.

Mitigations:
  - Encryption of all data packets emanating from the smartphone to a retransmission device via two encrypted tunnels with Suite B cryptography, all the way to the VPN gateway at the datacenter.

Related CWEs: 311
MITRE CAPEC-61: Session Fixation

Description:
The attacker induces a client to establish a session with the target software using a session identifier provided by the attacker. Once the user successfully authenticates to the target software, the attacker uses the (now privileged) session identifier in their own transactions. This attack leverages the fact that the target software either relies on client-generated session identifiers or maintains the same session identifiers after privilege elevation.

Mitigations:
  - Use a strict session management mechanism that only accepts locally generated session identifiers: This prevents attackers from fixating session identifiers of their own choice.
  - Regenerate and destroy session identifiers when there is a change in the level of privilege: This ensures that even though a potential victim may have followed a link with a fixated identifier, a new 
  - Use session identifiers that are difficult to guess or brute-force: One way for the attackers to obtain valid session identifiers is by brute-forcing or guessing them. By choosing session identifiers 

Related CWEs: 384, 664, 732
MITRE CAPEC-610: Cellular Data Injection

Description:
Adversaries inject data into mobile technology traffic (data flows or signaling data) to disrupt communications or conduct additional surveillance operations.

Mitigations:
  - Commercial defensive technology to detect and alert to any attempts to modify mobile technology data flows or to inject new data into existing data flows and signaling data.
MITRE CAPEC-611: BitSquatting

Description:
An adversary registers a domain name one bit different than a trusted domain. A BitSquatting attack leverages random errors in memory to direct Internet traffic to adversary-controlled destinations. BitSquatting requires no exploitation or complicated reverse engineering, and is operating system and architecture agnostic. Experimental observations show that BitSquatting popular websites could redirect non-trivial amounts of Internet traffic to a malicious entity.

Mitigations:
  - Authenticate all servers and perform redundant checks when using DNS hostnames.
  - When possible, use error-correcting (ECC) memory in local devices as non-ECC memory is significantly more vulnerable to faults.
MITRE CAPEC-612: WiFi MAC Address Tracking

Description:
In this attack scenario, the attacker passively listens for WiFi messages and logs the associated Media Access Control (MAC) addresses. These addresses are intended to be unique to each wireless device (although they can be configured and changed by software). Once the attacker is able to associate a MAC address with a particular user or set of users (for example, when attending a public event), the attacker can then scan for that MAC address to track that user in the future.

Mitigations:
  - Automatic randomization of WiFi MAC addresses
  - Frequent changing of handset and retransmission device

Related CWEs: 201, 300
MITRE CAPEC-613: WiFi SSID Tracking

Description:
In this attack scenario, the attacker passively listens for WiFi management frame messages containing the Service Set Identifier (SSID) for the WiFi network. These messages are frequently transmitted by WiFi access points (e.g., the retransmission device) as well as by clients that are accessing the network (e.g., the handset/mobile device). Once the attacker is able to associate an SSID with a particular user or set of users (for example, when attending a public event), the attacker can then scan for this SSID to track that user in the future.

Mitigations:
  - Do not enable the feature of "Hidden SSIDs" (also known as "Network Cloaking") – this option disables the usual broadcasting of the SSID by the access point, but forces the mobile handset to send requ
  - Frequently change the SSID to new and unrelated values

Related CWEs: 201, 300
MITRE CAPEC-614: Rooting SIM Cards

Description:
SIM cards are the de facto trust anchor of mobile devices worldwide. The cards protect the mobile identity of subscribers, associate devices with phone numbers, and increasingly store payment credentials, for example in NFC-enabled phones with mobile wallets. This attack leverages over-the-air (OTA) updates deployed via cryptographically-secured SMS messages to deliver executable code to the SIM. By cracking the DES key, an attacker can send properly signed binary SMS messages to a device, which are treated as Java applets and are executed on the SIM. These applets are allowed to send SMS, change voicemail numbers, and query the phone location, among many other predefined functions. These capabilities alone provide plenty of potential for abuse.

Mitigations:
  - Upgrade the SIM card to use the state-of-the-art AES or the somewhat outdated 3DES algorithm for OTA.

Related CWEs: 327
MITRE CAPEC-615: Evil Twin Wi-Fi Attack

Description:
Adversaries install Wi-Fi equipment that acts as a legitimate Wi-Fi network access point. When a device connects to this access point, Wi-Fi data traffic is intercepted, captured, and analyzed. This also allows the adversary to use "adversary-in-the-middle" (CAPEC-94) for all communications.

Mitigations:
  - Commercial defensive technology that monitors for rogue Wi-Fi access points, adversary-in-the-middle attacks, and anomalous activity with the mobile device baseband radios.

Related CWEs: 300
MITRE CAPEC-616: Establish Rogue Location

Description:
An adversary provides a malicious version of a resource at a location that is similar to the expected location of a legitimate resource. After establishing the rogue location, the adversary waits for a victim to visit the location and access the malicious resource.

Related CWEs: 200
MITRE CAPEC-617: Cellular Rogue Base Station

Description:
In this attack scenario, the attacker imitates a cellular base station with their own "rogue" base station equipment. Since cellular devices connect to whatever station has the strongest signal, the attacker can easily convince a targeted cellular device (e.g. the retransmission device) to talk to the rogue base station.

Mitigations:
  - Passively monitor cellular network connection for real-time threat detection and logging for manual review.
MITRE CAPEC-618: Cellular Broadcast Message Request

Description:
In this attack scenario, the attacker uses knowledge of the target’s mobile phone number (i.e., the number associated with the SIM used in the retransmission device) to cause the cellular network to send broadcast messages to alert the mobile device. Since the network knows which cell tower the target’s mobile device is attached to, the broadcast messages are only sent in the Location Area Code (LAC) where the target is currently located. By triggering the cellular broadcast message and then listening for the presence or absence of that message, an attacker could verify that the target is in (or not in) a given location.

Mitigations:
  - Frequent changing of mobile number.

Related CWEs: 201
MITRE CAPEC-619: Signal Strength Tracking

Description:
In this attack scenario, the attacker passively monitors the signal strength of the target’s cellular RF signal or WiFi RF signal and uses the strength of the signal (with directional antennas and/or from multiple listening points at once) to identify the source location of the signal. Obtaining the signal of the target can be accomplished through multiple techniques such as through Cellular Broadcast Message Request or through the use of IMSI Tracking or WiFi MAC Address Tracking.

Related CWEs: 201
MITRE CAPEC-62: Cross Site Request Forgery

Description:
An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.

Mitigations:
  - Use cryptographic tokens to associate a request with a specific action. The token can be regenerated at every request so that if a request with an invalid token is encountered, it can be reliably disc
  - Although less reliable, the use of the optional HTTP Referrer header can also be used to determine whether an incoming request was actually one that the user is authorized for, in the current context.
  - Additionally, the user can also be prompted to confirm an action every time an action concerning potentially sensitive data is invoked. This way, even if the attacker manages to get the user to click 

Related CWEs: 352, 306, 664, 732, 1275
MITRE CAPEC-620: Drop Encryption Level

Description:
An attacker forces the encryption level to be lowered, thus enabling a successful attack against the encrypted data.

Related CWEs: 757
MITRE CAPEC-621: Analysis of Packet Timing and Sizes

Description:
An attacker may intercept and log encrypted transmissions for the purpose of analyzing metadata such as packet timing and sizes. Although the actual data may be encrypted, this metadata may reveal valuable information to an attacker. Note that this attack is applicable to VOIP data as well as application data, especially for interactive apps that require precise timing and low-latency (e.g. thin-clients).

Mitigations:
  - Distort packet sizes and timing at VPN layer by adding padding to normalize packet sizes and timing delays to reduce information leakage via timing.

Related CWEs: 201
MITRE CAPEC-622: Electromagnetic Side-Channel Attack

Description:
In this attack scenario, the attacker passively monitors electromagnetic emanations that are produced by the targeted electronic device as an unintentional side-effect of its processing. From these emanations, the attacker derives information about the data that is being processed (e.g. the attacker can recover cryptographic keys by monitoring emanations associated with cryptographic processing). This style of attack requires proximal access to the device, however attacks have been demonstrated at public conferences that work at distances of up to 10-15 feet. There have not been any significant studies to determine the maximum practical distance for such attacks. Since the attack is passive, it is nearly impossible to detect and the targeted device will continue to operate as normal after a successful attack.

Mitigations:
  - Utilize side-channel resistant implementations of all crypto algorithms.
  - Strong physical security of all devices that contain secret key information. (even when devices are not in use)

Related CWEs: 201
MITRE CAPEC-623: Compromising Emanations Attack

Description:
Compromising Emanations (CE) are defined as unintentional signals which an attacker may intercept and analyze to disclose the information processed by the targeted equipment. Commercial mobile devices and retransmission devices have displays, buttons, microchips, and radios that emit mechanical emissions in the form of sound or vibrations. Capturing these emissions can help an adversary understand what the device is doing.

Mitigations:
  - None are known.

Related CWEs: 201
MITRE CAPEC-624: Hardware Fault Injection

Description:
The adversary uses disruptive signals or events, or alters the physical environment a device operates in, to cause faulty behavior in electronic devices. This can include electromagnetic pulses, laser pulses, clock glitches, ambient temperature extremes, and more. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information.

Mitigations:
  - Implement robust physical security countermeasures and monitoring.

Related CWEs: 1247, 1248, 1256, 1319, 1332, 1334, 1338, 1351
MITRE CAPEC-625: Mobile Device Fault Injection

Description:
Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised.

Mitigations:
  - Strong physical security of all devices that contain secret key information. (even when devices are not in use)
  - Frequent changes to secret keys and certificates.

Related CWEs: 1247, 1248, 1256, 1319, 1332, 1334, 1338, 1351
MITRE CAPEC-626: Smudge Attack

Description:
Attacks that reveal the password/passcode pattern on a touchscreen device by detecting oil smudges left behind by the user’s fingers.

Mitigations:
  - Strong physical security of the device.