COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-387

Navigation Remapping To Propagate Malicious Content

An adversary manipulates either egress or ingress data from a client within an application framework in order to change the content of messages and thereby circumvent the expected application logic.

Abstraction

Detailed

Typical severity

Medium

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

An adversary manipulates either egress or ingress data from a client within an application framework in order to change the content of messages and thereby circumvent the expected application logic.

Extended description

Performing this attack allows the adversary to manipulate content in such a way as to produce messages or content that look authentic but may contain deceptive links, spam-like content, or links to the adversarys' code. In general, content-spoofing within an application API can be employed to stage many different types of attacks varied based on the adversarys' intent. When the goal is to spread malware, deceptive content is created such as modified links, buttons, or images, that entice users to click on those items, all of which point to a malicious URI. The techniques require use of specialized software that allow the adversary to use adversary-in-the-middle ( CAPEC-94 ) communications between the web browser and the remote system in order to change the destination of various application interface elements.

Requirements

What does the attack require?

Prerequisites

  • Targeted software is utilizing application framework APIs

Skills required

Not stated in the MITRE record.

Resources required

  • A software program that allows the use of adversary-in-the-middle communications between the client and server, such as a man-in-the-middle proxy.