An attacker exploits characteristics of the infrastructure of a network entity in order to perpetrate attacks or information gathering on network objects or effect a change in the ordinary information flow between network objects. Most often, this involves manipulation of the routing of network messages so, instead of arriving at their proper destination, they are directed towards an entity of the attackers' choosing, usually a server controlled by the attacker. The victim is often unaware that their messages are not being processed correctly. For example, a targeted client may believe they are connecting to their own bank but, in fact, be connecting to a Pharming site controlled by the attacker which then collects the user's login information in order to hijack the actual bank account.

What weaknesses does CAPEC-161 target?

CAPEC-161 exploits 1 CWE weakness, including CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints).

How severe is CAPEC-161?

MITRE rates CAPEC-161 as High severity.

CAPEC-161: Infrastructure Manipulation

Overview

CAPEC-161 (Infrastructure Manipulation) is a meta-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.

What the attacker needs

Prerequisites

The targeted client must access the site via infrastructure that the attacker has co-opted and must fail to adequately verify that the communication channel is operating correctly (e.g. by verifying that they are, in fact, connected to the site they intended.)

Resources required

The attacker must be able to corrupt the infrastructure used by the client. For some variants of this attack, the attacker must be able to stand up their own services that mimic the services the targeted client intends to use.

The CWE weaknesses that CAPEC-161 exploits.

CWE-923: Improper Restriction of Communication Channel to Intended Endpoints

How this attack relates to others in the CAPEC hierarchy.

Child

Can precede

CAPEC-664: Server Side Request Forgery

Frequently asked questions

Common questions about CAPEC-161.

What is CAPEC-161?: An attacker exploits characteristics of the infrastructure of a network entity in order to perpetrate attacks or information gathering on network objects or effect a change in the ordinary information flow between network objects. Most often, this involves manipulation of the routing of network messages so, instead of arriving at their proper destination, they are directed towards an entity of the attackers' choosing, usually a server controlled by the attacker. The victim is often unaware that their messages are not being processed correctly. For example, a targeted client may believe they are connecting to their own bank but, in fact, be connecting to a Pharming site controlled by the attacker which then collects the user's login information in order to hijack the actual bank account.
What weaknesses does CAPEC-161 target?: CAPEC-161 exploits 1 CWE weakness, including CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints).
How severe is CAPEC-161?: MITRE rates CAPEC-161 as High severity.

References

Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.