Home > CAPEC List > CAPEC-116: Excavation (Version 2.9)  

CAPEC-116: Excavation

 
Excavation
Definition in a New Window Definition in a New Window
Attack Pattern ID: 116
Abstraction: Meta
Status: Draft
Completeness: Stub
Presentation Filter:
+ Summary

An adversary actively probes the target in a manner that is designed to solicit information relevant to system security. This is achieved by exploring the target via ordinary interactions for the purpose of gathering intelligence about the target, or by sending data that is syntactically invalid or non-standard in an attempt to produce a response that contains the desired data. As a result of the excavation activities, the adversary is able to obtain information from the target that aids the attacker in making inferences about its security, configuration, or potential vulnerabilities. Examplar exchanges with the target may trigger unhandled exceptions or verbose error messages that reveal information like stack traces, configuration information, path information, or database design. This type of attack also includes the manipulation of query strings in a URI to produce invalid SQL queries, or by trying alternative path values in the hope that the server will return useful information.

Excavated data is often moved from the target system to some other adversary controlled system. Data found on a target system might require extensive resources to be fully analyzed. Using these resources on the target system might enable a defender to detect the adversary. Additionally, proper analysis tools required might not be available on the target system.

This attack differs from Data Interception and other data collection attacks in that the attacker actively queries the target rather than simply watching for the target to reveal information.

+ Attack Prerequisites
  • An adversary requires some way of interacting with the system in order to successfully probe it.

+ Typical Severity

Medium

+ Resources Required

A web browser or a client application capable of sending custom protocol messages, such as a MITM Proxy or a fuzzer, or a similar scanner or packet injection tool.

+ Content History
Submissions
SubmitterOrganizationDateSource
CAPEC Content TeamThe MITRE Corporation2014-06-23Internal_CAPEC_Team
Modifications
ModifierOrganizationDateCommentsSource
CAPEC Content TeamThe MITRE Corporation2015-11-09Updated Activation_Zone, Attack_Prerequisites, Description Summary, Injection_Vector, Payload, Payload_Activation_ImpactInternal

More information is available — Please select a different filter.
Page Last Updated or Reviewed: December 07, 2015