MetaSeverity: Very LowCAPEC-169

CAPEC-169: Footprinting

Description

An adversary engages in probing and exploration activities to identify constituents and properties of the target.

Likelihood of attack: High
Typical severity: Very Low
Abstraction: MetaA decidedly abstract characterisation of a methodology or technique.

Mechanism of attack: Collect and Analyze Information

Prerequisites

An application must publicize identifiable information about the system or application through voluntary or involuntary means. Certain identification details of information systems are visible on communication networks (e.g., if an adversary uses a sniffer to inspect the traffic) due to their inherent structure and protocol standards. Any system or network that can be detected can be footprinted. However, some configuration choices may limit the useful information that can be collected during a...

Skills required

LowThe adversary knows how to send HTTP request, run the scan tool.

Consequences

Confidentiality
Read Data

Mitigations

Keep patches up to date by installing weekly or daily if possible.
Shut down unnecessary services/ports.
Change default passwords by choosing strong passwords.
Curtail unexpected input.
Encrypt and password-protect sensitive data.
Avoid including information that has the potential to identify and compromise your organization's security such as access to business plans, formulas, and proprietary documents.

Related weaknesses (CWE)

CWE-200Exposure of Sensitive Information to an Unauthorized Actor

ATT&CK techniques (CAPEC taxonomy mapping)

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

Related attack patterns

More specific patterns

Prerequisites

An application must publicize identifiable information about the system or application through voluntary or involuntary means. Certain identification details of information systems are visible on communication networks (e.g., if an adversary uses a sniffer to inspect the traffic) due to their inherent structure and protocol standards. Any system or network that can be detected can be footprinted. However, some configuration choices may limit the useful information that can be collected during a...

Mitigations

Keep patches up to date by installing weekly or daily if possible.

Shut down unnecessary services/ports.

Change default passwords by choosing strong passwords.

Curtail unexpected input.

Encrypt and password-protect sensitive data.

Avoid including information that has the potential to identify and compromise your organization's security such as access to business plans, formulas, and proprietary documents.