CAPEC-529: Malware-Directed Internal Reconnaissance

Description

Adversary uses malware or a similarly controlled application installed inside an organizational perimeter to gather information about the composition, configuration, and security mechanisms of a targeted application, system or network.

Extended Description

XDoS is most closely associated with web services, SOAP, and Rest, because remote service requesters can post malicious XML payloads to the service provider designed to exhaust the service provider's memory, CPU, and/or disk space. The main weakness in XDoS is that the service provider generally must inspect, parse, and validate the XML messages to determine routing, workflow, security considerations, and so on. It is exactly these inspection, parsing, and validation routines that XDoS targets. This attack exploits the loosely coupled nature of web services, where the service provider has little to no control over the service requester and any messages the service requester sends.

Severity :

Medium

Possibility :

Medium

Type :

Standard

Relationships with other CAPECs

This table shows the other attack patterns and high level categories that are related to this attack pattern.

CAPEC-169: Footprinting Footprinting CAPEC-270: Modification of Registry Run Keys Modification of Registry Run Keys CAPEC-457: USB Memory Attacks USB Memory Attacks

Prerequisites

This table shows the other attack patterns and high level categories that are related to this attack pattern.

The adversary must have internal, logical access to the target network and system.

Skills required

This table shows the other attack patterns and high level categories that are related to this attack pattern.

Medium The adversary must be able to obtain or develop, as well as place malicious software inside the target network/system.

Taxonomy mappings

Mappings to ATT&CK, OWASP and other frameworks.

Resources required

The adversary requires a variety of tools to collect information about the target. These include port/network scanners and tools to analyze responses from applications to determine version and configuration information. Footprinting a system adequately may also take a few days if the attacker wishes the footprinting attempt to go undetected.

Related CWE

A Related Weakness relationship associates a weakness with this attack pattern. Each association implies a weakness that must exist for a given attack to be successful.

Visit http://capec.mitre.org/ for more details.