deardaniel/secdata-raw huggingface dataset:
MITRE CAPEC-244: XSS Targeting URI Placeholders

Description:
An attack of this type exploits the ability of most browsers to interpret "data", "javascript" or other URI schemes as client-side executable content placeholders. This attack consists of passing a malicious URI in an anchor tag HREF attribute or any other similar attributes in other HTML tags. Such malicious URI contains, for example, a base64 encoded HTML content with an embedded cross-site scripting payload. The attack is executed when the browser interprets the malicious content i.e., for example, when the victim clicks on the malicious link.

Mitigations:
  - Design: Use browser technologies that do not allow client side scripting.
  - Design: Utilize strict type, character, and encoding enforcement.
  - Implementation: Ensure all content that is delivered to client is sanitized against an acceptable content specification.

Related CWEs: 83
MITRE CAPEC-245: XSS Using Doubled Characters

Description:
The adversary bypasses input validation by using doubled characters in order to perform a cross-site scripting attack. Some filters fail to recognize dangerous sequences if they are preceded by repeated characters. For example, by doubling the < before a script command, (<<script or %3C%3script using URI encoding) the filters of some web applications may fail to recognize the presence of a script tag. If the targeted server is vulnerable to this type of bypass, the adversary can create a crafted URL or other trap to cause a victim to view a page on the targeted server where the malicious content is executed, as per a normal XSS attack.

Mitigations:
  - Design: Use libraries and templates that minimize unfiltered input.
  - Implementation: Normalize, filter and sanitize all user supplied fields.
  - Implementation: The victim should configure the browser to minimize active content from untrusted sources.

Related CWEs: 85
MITRE CAPEC-247: XSS Using Invalid Characters

Description:
An adversary inserts invalid characters in identifiers to bypass application filtering of input. Filters may not scan beyond invalid characters but during later stages of processing content that follows these invalid characters may still be processed. This allows the adversary to sneak prohibited commands past filters and perform normally prohibited operations. Invalid characters may include null, carriage return, line feed or tab in an identifier. Successful bypassing of the filter can result in a XSS attack, resulting in the disclosure of web cookies or possibly other results.

Mitigations:
  - Design: Use libraries and templates that minimize unfiltered input.
  - Implementation: Normalize, filter and use an allowlist for any input that will be included in any subsequent web pages or back end operations.
  - Implementation: The victim should configure the browser to minimize active content from untrusted sources.

Related CWEs: 86
MITRE CAPEC-248: Command Injection

Description:
An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.

Mitigations:
  - All user-controllable input should be validated and filtered for potentially unwanted characters. Using an allowlist for input is desired, but if use of a denylist approach is necessary, then focusing
  - Input should be encoded prior to use in commands to make sure command related characters are not treated as part of the command. For example, quotation characters may need to be encoded so that the ap
  - Input should be parameterized, or restricted to data sections of a command, thus removing the chance that the input will be treated as part of the command itself.

Related CWEs: 77
MITRE CAPEC-25: Forced Deadlock

Description:
The adversary triggers and exploits a deadlock condition in the target software to cause a denial of service. A deadlock can occur when two or more competing actions are waiting for each other to finish, and thus neither ever does. Deadlock conditions can be difficult to detect.

Mitigations:
  - Use known algorithm to avoid deadlock condition (for instance non-blocking synchronization algorithms).
  - For competing actions, use well-known libraries which implement synchronization.

Related CWEs: 412, 567, 662, 667, 833, 1322
MITRE CAPEC-250: XML Injection

Description:
An attacker utilizes crafted XML user-controllable input to probe, attack, and inject data into the XML database, using techniques similar to SQL injection. The user-controllable input can allow for unauthorized viewing of data, bypassing authentication or the front-end application for direct XML database access, and possibly altering database information.

Mitigations:
  - Strong input validation - All user-controllable input must be validated and filtered for illegal characters as well as content that can be interpreted in the context of an XML data or a query.
  - Use of custom error pages - Attackers can glean information about the nature of queries from descriptive error messages. Input validation must be coupled with customized error pages that inform about 

Related CWEs: 91, 74, 20, 707
MITRE CAPEC-251: Local Code Inclusion

Description:
The attacker forces an application to load arbitrary code files from the local machine. The attacker could use this to try to load old versions of library files that have known vulnerabilities, to load files that the attacker placed on the local machine during a prior attack, or to otherwise change the functionality of the targeted application in unexpected ways.

Mitigations:
  - Implementation: Avoid passing user input to filesystem or framework API. If necessary to do so, implement a specific, allowlist approach.

Related CWEs: 829
MITRE CAPEC-252: PHP Local File Inclusion

Description:
The attacker loads and executes an arbitrary local PHP file on a target machine. The attacker could use this to try to load old versions of PHP files that have known vulnerabilities, to load PHP files that the attacker placed on the local machine during a prior attack, or to otherwise change the functionality of the targeted application in unexpected ways.

Related CWEs: 829
MITRE CAPEC-253: Remote Code Inclusion

Description:
The attacker forces an application to load arbitrary code files from a remote location. The attacker could use this to try to load old versions of library files that have known vulnerabilities, to load malicious files that the attacker placed on the remote machine, or to otherwise change the functionality of the targeted application in unexpected ways.

Mitigations:
  - Minimize attacks by input validation and sanitization of any user data that will be used by the target application to locate a remote file to be included.

Related CWEs: 829
MITRE CAPEC-256: SOAP Array Overflow

Description:
An attacker sends a SOAP request with an array whose actual length exceeds the length indicated in the request. If the server processing the transmission naively trusts the specified size, then an attacker can intentionally understate the size of the array, possibly resulting in a buffer overflow if the server attempts to read the entire data set into the memory it allocated for a smaller array.

Mitigations:
  - If the server either verifies the correctness of the stated array size or if the server stops processing an array once the stated number of elements have been read, regardless of the actual array size

Related CWEs: 805
MITRE CAPEC-26: Leveraging Race Conditions

Description:
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.

Mitigations:
  - Use safe libraries to access resources such as files.
  - Be aware that improper use of access function calls such as chown(), tempfile(), chmod(), etc. can cause a race condition.
  - Use synchronization to control the flow of execution.

Related CWEs: 368, 363, 366, 370, 362, 662, 689, 667, 665, 1223
MITRE CAPEC-261: Fuzzing for garnering other adjacent user/sensitive data

Description:
An adversary who is authorized to send queries to a target sends variants of expected queries in the hope that these modified queries might return information (directly or indirectly through error logs) beyond what the expected set of queries should provide.

Related CWEs: 20
MITRE CAPEC-263: Force Use of Corrupted Files

Description:
This describes an attack where an application is forced to use a file that an attacker has corrupted. The result is often a denial of service caused by the application being unable to process the corrupted file, but other results, including the disabling of filters or access controls (if the application fails in an unsafe way rather than failing by locking down) or buffer overflows are possible.

Related CWEs: 829
MITRE CAPEC-267: Leverage Alternate Encoding

Description:
An adversary leverages the possibility to encode potentially harmful input or content used by applications such that the applications are ineffective at validating this encoding standard.

Mitigations:
  - Assume all input might use an improper representation. Use canonicalized data inside the application; all data must be converted into the representation used inside the application (UTF-8, UTF-16, etc
  - Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should 

Related CWEs: 173, 172, 180, 181, 73, 74, 20, 697, 692
MITRE CAPEC-268: Audit Log Manipulation

Description:
The attacker injects, manipulates, deletes, or forges malicious log entries into the log file, in an attempt to mislead an audit of the log file or cover tracks of an attack. Due to either insufficient access controls of the log files or the logging mechanism, the attacker is able to perform such actions.

Related CWEs: 117
MITRE CAPEC-27: Leveraging Race Conditions via Symbolic Links

Description:
This attack leverages the use of symbolic links (Symlinks) in order to write to sensitive files. An attacker can create a Symlink link to a target file not otherwise accessible to them. When the privileged program tries to create a temporary file with the same name as the Symlink link, it will actually write to the target file pointed to by the attackers' Symlink link. If the attacker can insert malicious content in the temporary file they will be writing to the sensitive file by using the Symlink. The race occurs because the system checks if the temporary file exists, then creates the file. The attacker would typically create the Symlink during the interval between the check and the creation of the temporary file.

Mitigations:
  - Use safe libraries when creating temporary files. For instance the standard library function mkstemp can be used to safely create temporary files. For shell scripts, the system utility mktemp does the
  - Access to the directories should be restricted as to prevent attackers from manipulating the files. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive
  - Follow the principle of least privilege when assigning access rights to files.

Related CWEs: 367, 61, 662, 689, 667
MITRE CAPEC-270: Modification of Registry Run Keys

Description:
An adversary adds a new entry to the "run keys" in the Windows registry so that an application of their choosing is executed when a user logs in. In this way, the adversary can get their executable to operate and run on the target system with the authorized user's level of permissions. This attack is a good way for an adversary to run persistent spyware on a user's machine, such as a keylogger.

Mitigations:
  - Identify programs that may be used to acquire process information and block them by using a software restriction policy or tools that restrict program execution by using a process allowlist.

Related CWEs: 15
MITRE CAPEC-271: Schema Poisoning

Description:
An adversary corrupts or modifies the content of a schema for the purpose of undermining the security of the target. Schemas provide the structure and content definitions for resources used by an application. By replacing or modifying a schema, the adversary can affect how the application handles or interprets a resource, often leading to possible denial of service, entering into an unexpected state, or recording incomplete data.

Mitigations:
  - Design: Protect the schema against unauthorized modification.
  - Implementation: For applications that use a known schema, use a local copy or a known good repository instead of the schema reference supplied in the schema document.
  - Implementation: For applications that leverage remote schemas, use the HTTPS protocol to prevent modification of traffic in transit and to avoid unauthorized modification.

Related CWEs: 15
MITRE CAPEC-272: Protocol Manipulation

Description:
An adversary subverts a communications protocol to perform an attack. This type of attack can allow an adversary to impersonate others, discover sensitive information, control the outcome of a session, or perform other attacks. This type of attack targets invalid assumptions that may be inherent in implementers of the protocol, incorrect implementations of the protocol, or vulnerabilities in the protocol itself.
MITRE CAPEC-273: HTTP Response Smuggling

Description:
An adversary manipulates and injects malicious content in the form of secret unauthorized HTTP responses, into a single HTTP response from a vulnerable or compromised back-end HTTP agent (e.g., server). 
             See CanPrecede relationships for possible consequences.

Mitigations:
  - Design: evaluate HTTP agents prior to deployment for parsing/interpretation discrepancies.
  - Configuration: front-end HTTP agents notice ambiguous requests.
  - Configuration: back-end HTTP agents reject ambiguous requests and close the network connection.

Related CWEs: 74, 436, 444
MITRE CAPEC-274: HTTP Verb Tampering

Description:
An attacker modifies the HTTP Verb (e.g. GET, PUT, TRACE, etc.) in order to bypass access restrictions. Some web environments allow administrators to restrict access based on the HTTP Verb used with requests. However, attackers can often provide a different HTTP Verb, or even provide a random string as a verb in order to bypass these protections. This allows the attacker to access data that should otherwise be protected.

Mitigations:
  - Design: Ensure that only legitimate HTTP verbs are allowed.
  - Design: Do not use HTTP verbs as factors in access decisions.

Related CWEs: 302, 654
MITRE CAPEC-275: DNS Rebinding

Description:
An adversary serves content whose IP address is resolved by a DNS server that the adversary controls. After initial contact by a web browser (or similar client), the adversary changes the IP address to which its name resolves, to an address within the target organization that is not publicly accessible. This allows the web browser to examine this internal address on behalf of the adversary.

Mitigations:
  - Design: IP Pinning causes browsers to record the IP address to which a given name resolves and continue using this address regardless of the TTL set in the DNS response. Unfortunately, this is incompa
  - Implementation: Reject HTTP request with a malicious Host header.
  - Implementation: Employ DNS resolvers that prevent external names from resolving to internal addresses.

Related CWEs: 350
MITRE CAPEC-276: Inter-component Protocol Manipulation

Description:
Inter-component protocols are used to communicate between different software and hardware modules within a single computer. Common examples are: interrupt signals and data pipes. Subverting the protocol can allow an adversary to impersonate others, discover sensitive information, control the outcome of a session, or perform other attacks. This type of attack targets invalid assumptions that may be inherent in implementers of the protocol, incorrect implementations of the protocol, or vulnerabilities in the protocol itself.

Related CWEs: 707
MITRE CAPEC-277: Data Interchange Protocol Manipulation

Description:
Data Interchange Protocols are used to transmit structured data between entities. These protocols are often specific to a particular domain (B2B: purchase orders, invoices, transport logistics and waybills, medical records). They are often, but not always, XML-based. Subverting the protocol can allow an adversary to impersonate others, discover sensitive information, control the outcome of a session, or perform other attacks. This type of attack targets invalid assumptions that may be inherent in implementers of the protocol, incorrect implementations of the protocol, or vulnerabilities in the protocol itself.

Related CWEs: 707
MITRE CAPEC-278: Web Services Protocol Manipulation

Description:
An adversary manipulates a web service related protocol to cause a web application or service to react differently than intended. This can either be performed through the manipulation of call parameters to include unexpected values, or by changing the called function to one that should normally be restricted or limited. By leveraging this pattern of attack, the adversary is able to gain access to data or resources normally restricted, or to cause the application or service to crash.

Mitigations:
  - Design: Range, size and value and consistency verification for any arguments supplied to applications and services from external sources and devise appropriate error response.
  - Design: Ensure that function calls that should not be called by an unprivileged user are not accessible to them.

Related CWEs: 707
MITRE CAPEC-279: SOAP Manipulation

Description:
Simple Object Access Protocol (SOAP) is used as a communication protocol between a client and server to invoke web services on the server. It is an XML-based protocol, and therefore suffers from many of the same shortcomings as other XML-based protocols. Adversaries can make use of these shortcomings and manipulate the content of SOAP paramters, leading to undesirable behavior on the server and allowing the adversary to carry out a number of further attacks.

Related CWEs: 707
MITRE CAPEC-28: Fuzzing

Description:
In this attack pattern, the adversary leverages fuzzing to try to identify weaknesses in the system. Fuzzing is a software security and functionality testing method that feeds randomly constructed input to the system and looks for an indication that a failure in response to that input has occurred. Fuzzing treats the system as a black box and is totally free from any preconceptions or assumptions about the system. Fuzzing can help an attacker discover certain assumptions made about user input in the system. Fuzzing gives an attacker a quick way of potentially uncovering some of these assumptions despite not necessarily knowing anything about the internals of the system. These assumptions can then be turned against the system by specially crafting user input that may allow an attacker to achieve their goals.

Mitigations:
  - Test to ensure that the software behaves as per specification and that there are no unintended side effects. Ensure that no assumptions about the validity of data are made.
  - Use fuzz testing during the software QA process to uncover any surprises, uncover any assumptions or unexpected behavior.

Related CWEs: 74, 20
MITRE CAPEC-285: ICMP Echo Request Ping

Description:
An adversary sends out an ICMP Type 8 Echo Request, commonly known as a 'Ping', in order to determine if a target system is responsive. If the request is not blocked by a firewall or ACL, the target host will respond with an ICMP Type 0 Echo Reply datagram. This type of exchange is usually referred to as a 'Ping' due to the Ping utility present in almost all operating systems. Ping, as commonly implemented, allows a user to test for alive hosts, measure round-trip time, and measure the percentage of packet loss.

Mitigations:
  - Consider configuring firewall rules to block ICMP Echo requests and prevent replies. If not practical, monitor and consider action when a system has fast and a repeated pattern of requests that move i

Related CWEs: 200
MITRE CAPEC-287: TCP SYN Scan

Description:
An adversary uses a SYN scan to determine the status of ports on the remote target. SYN scanning is the most common type of port scanning that is used because of its many advantages and few drawbacks. As a result, novice attackers tend to overly rely on the SYN scan while performing system reconnaissance. As a scanning method, the primary advantages of SYN scanning are its universality and speed.

Related CWEs: 200
MITRE CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions

Description:
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.

Mitigations:
  - Use safe libraries to access resources such as files.
  - Be aware that improper use of access function calls such as chown(), tempfile(), chmod(), etc. can cause a race condition.
  - Use synchronization to control the flow of execution.

Related CWEs: 367, 368, 366, 370, 362, 662, 691, 663, 665
MITRE CAPEC-290: Enumerate Mail Exchange (MX) Records

Description:
An adversary enumerates the MX records for a given via a DNS query. This type of information gathering returns the names of mail servers on the network. Mail servers are often not exposed to the Internet but are located within the DMZ of a network protected by a firewall. A side effect of this configuration is that enumerating the MX records for an organization my reveal the IP address of the firewall or possibly other internal systems. Attackers often resort to MX record enumeration when a DNS Zone Transfer is not possible.

Related CWEs: 200
MITRE CAPEC-291: DNS Zone Transfers

Description:
An attacker exploits a DNS misconfiguration that permits a ZONE transfer. Some external DNS servers will return a list of IP address and valid hostnames. Under certain conditions, it may even be possible to obtain Zone data about the organization's internal network. When successful the attacker learns valuable information about the topology of the target organization, including information about particular servers, their role within the IT structure, and possibly information about the operating systems running upon the network. This is configuration dependent behavior so it may also be required to search out multiple DNS servers while attempting to find one with ZONE transfers allowed.

Related CWEs: 200