Dark Mode
Capec-116 Detail
Excavation
Meta Supply Chain Software Physical Security Hardware Likelihood: High Typical Severity: Medium
Children: 54 150 545 569 675
Threats: T60 T65 T258 T273 T291 T302
Tools: 17
An adversary actively probes the target in a manner that is designed to solicit information that could be leveraged for malicious purposes.
This is achieved by exploring the target via ordinary interactions for the purpose of gathering intelligence about the target, or by sending data that is syntactically invalid or non-standard in an attempt to produce a response that contains the desired data. As a result of these interactions, the adversary is able to obtain information from the target that aids the attacker in making inferences about its security, configuration, or potential vulnerabilities. Examplar exchanges with the target may trigger unhandled exceptions or verbose error messages that reveal information like stack traces, configuration information, path information, or database design. This type of attack also includes the manipulation of query strings in a URI to produce invalid SQL queries, or by trying alternative path values in the hope that the server will return useful information.
| External ID | Source | Link | Description |
|---|---|---|---|
| CAPEC-116 | capec | https://capec.mitre.org/data/definitions/116.html | |
| CWE-200 | cwe | http://cwe.mitre.org/data/definitions/200.html | |
| CWE-1243 | cwe | http://cwe.mitre.org/data/definitions/1243.html |
Not present
- An adversary requires some way of interacting with the system.
- A tool, such as an Adversary in the Middle (CAPEC-94) Proxy or a fuzzer, that is capable of generating and injecting custom inputs to be used in the attack.
Not present
| Confidentiality |
|---|
| Read Data |
Not present