{
    "id": "bundle--7bd63075-1170-4cbb-8e3b-0bbc89944ea2",
    "objects": [
        {
            "created": "2014-06-23T00:00:00.000Z",
            "created_by_ref": "identity--e50ab59c-5c4f-4d40-bf6a-d58418d89bcd",
            "description": "An attacker manipulates an existing credential in order to gain access to a target application. Session credentials allow users to identify themselves to a service after an initial authentication without needing to resend the authentication information (usually a username and password) with every message. An attacker may be able to manipulate a credential sniffed from an existing connection in order to gain access to a target server.",
            "external_references": [
                {
                    "external_id": "CAPEC-226",
                    "source_name": "capec",
                    "url": "https://capec.mitre.org/data/definitions/226.html"
                },
                {
                    "external_id": "CWE-565",
                    "source_name": "cwe",
                    "url": "http://cwe.mitre.org/data/definitions/565.html"
                },
                {
                    "external_id": "CWE-472",
                    "source_name": "cwe",
                    "url": "http://cwe.mitre.org/data/definitions/472.html"
                }
            ],
            "id": "attack-pattern--012db73f-2f3c-49f3-bdf3-12ec3eee01ce",
            "modified": "2022-02-22T00:00:00.000Z",
            "name": "Session Credential Falsification through Manipulation",
            "object_marking_refs": [
                "marking-definition--17d82bb2-eeeb-4898-bda5-3ddbcd2b799d"
            ],
            "spec_version": "2.1",
            "type": "attack-pattern",
            "x_capec_abstraction": "Detailed",
            "x_capec_child_of_refs": [
                "attack-pattern--414d0884-4f46-4a51-b4ea-72125c7f5f9e"
            ],
            "x_capec_domains": [
                "Software"
            ],
            "x_capec_extended_description": "\n            <xhtml:p>For example, a credential in the form of a web cookie might have a field that indicates the access rights of a user. By manually tweaking this cookie, a user might be able to increase their access rights to the server. Alternately an attacker may be able to manipulate an existing credential to appear as a different user. This attack differs from falsification through prediction in that the user bases their modified credentials off existing credentials instead of using patterns detected in prior credentials to create a new credential that is accepted because it fits the pattern. As a result, an attacker may be able to impersonate other users or elevate their permissions to a targeted service.</xhtml:p>\n         ",
            "x_capec_prerequisites": [
                "The targeted application must use session credentials to identify legitimate users."
            ],
            "x_capec_resources_required": [
                "An attacker will need tools to sniff existing credentials (possibly their own) in order to retrieve a base credential for modification. They will need to understand how the components of the credential affect server behavior and how to manipulate this behavior by changing the credential. Finally, they will need tools to allow them to craft and transmit a modified credential."
            ],
            "x_capec_status": "Draft",
            "x_capec_typical_severity": "Medium",
            "x_capec_version": "3.9"
        }
    ],
    "type": "bundle"
}