Home > CAPEC List > CAPEC-214: Fuzzing for garnering J2EE/.NET-based stack traces, for application mapping (Version 3.2)  

CAPEC-214: Fuzzing for garnering J2EE/.NET-based stack traces, for application mapping

Attack Pattern ID: 214
Abstraction: Detailed
Status: Draft
Presentation Filter:
+ Description
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
+ Typical Severity


+ Relationships

The table below shows the other attack patterns and high level categories that are related to this attack pattern. These relationships are defined as ChildOf and ParentOf, and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as CanFollow, PeerOf, and CanAlsoBe are defined to show similar attack patterns that the user may want to explore.

ChildOfStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.54Query System for Information

The table below shows the views that this attack pattern belongs to and top level categories within that view.

+ Prerequisites
The target application must fail to sanitize incoming messages adequately before processing and must generate a stack trace in at least some error situations.
+ Resources Required
The attacker must have sufficient access to send messages to the target. The attacker must also have the ability to observe the stack trace produced by the target application. Fuzzing tools, which automatically generate and send message variants, are necessary for this attack.
+ Content History
Submission DateSubmitterOrganization
2014-06-23CAPEC Content TeamThe MITRE Corporation
More information is available — Please select a different filter.
Page Last Updated or Reviewed: September 30, 2019