New to CAPEC? Start Here
Home > CAPEC List > CAPEC-133: Try All Common Switches (Version 3.9)  

CAPEC-133: Try All Common Switches

Attack Pattern ID: 133
Abstraction: Standard
View customized information:
+ Description
An attacker attempts to invoke all common switches and options in the target application for the purpose of discovering weaknesses in the target. For example, in some applications, adding a --debug switch causes debugging information to be displayed, which can sometimes reveal sensitive processing or configuration information to an attacker. This attack differs from other forms of API abuse in that the attacker is indiscriminately attempting to invoke options in the hope that one of them will work rather than specifically targeting a known option. Nonetheless, even if the attacker is familiar with the published options of a targeted application this attack method may still be fruitful as it might discover unpublicized functionality.
+ Typical Severity

Medium

+ Relationships
Section HelpThis table shows the other attack patterns and high level categories that are related to this attack pattern. These relationships are defined as ChildOf and ParentOf, and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as CanFollow, PeerOf, and CanAlsoBe are defined to show similar attack patterns that the user may want to explore.
NatureTypeIDName
ChildOfMeta Attack PatternMeta Attack Pattern - A meta level attack pattern in CAPEC is a decidedly abstract characterization of a specific methodology or technique used in an attack. A meta attack pattern is often void of a specific technology or implementation and is meant to provide an understanding of a high level approach. A meta level attack pattern is a generalization of related group of standard level attack patterns. Meta level attack patterns are particularly useful for architecture and design level threat modeling exercises.113Interface Manipulation
Section HelpThis table shows the views that this attack pattern belongs to and top level categories within that view.
View NameTop Level Categories
Domains of AttackSoftware
Mechanisms of AttackAbuse Existing Functionality
+ Execution Flow
Explore

  1. Identify application: Discover an application of interest by exploring service registry listings or by connecting on a known port or some similar means.

    Techniques
    Search via internet for known, published applications that allow option switches.
    Use automated tools to scan known ports to identify applications that might be accessible

  2. Authenticate to application: Authenticate to the application, if required, in order to explore it.

    Techniques
    Use published credentials to access system.
    Find unpublished credentails to access service.
    Use other attack pattern or weakness to bypass authentication.
Experiment

  1. Try all common switches: Using manual or automated means, attempt to run the application with many different known common switches. Observe the output to see if any switches seemed to put the application in a non production mode that might give more information.

    Techniques
    Manually execute the application with switches such as --debug, --test, --development, --verbose, etc.
    Use automated tools to run the application with common switches and observe the output
Exploit

  1. Use sensitive processing or configuration information: Once extra information is observed from an application through the use of a common switch, this information is used to aid other attacks on the application

    Techniques
    Using application information, formulate an attack on the application
+ Prerequisites
The attacker must be able to control the options or switches sent to the target.
+ Resources Required
None: No specialized resources are required to execute this type of attack. The only requirement is the ability to send requests to the target.
+ Mitigations
Design: Minimize switch and option functionality to only that necessary for correct function of the command.
Implementation: Remove all debug and testing options from production code.
+ Content History
Submissions
Submission DateSubmitterOrganization
2014-06-23
(Version 2.6)
CAPEC Content TeamThe MITRE Corporation
Modifications
Modification DateModifierOrganization
2015-12-07
(Version 2.8)
CAPEC Content TeamThe MITRE Corporation
Updated Related_Attack_Patterns
2017-08-04
(Version 2.11)
CAPEC Content TeamThe MITRE Corporation
Updated Resources_Required
2019-04-04
(Version 3.1)
CAPEC Content TeamThe MITRE Corporation
Updated Related_Weaknesses
2020-07-30
(Version 3.3)
CAPEC Content TeamThe MITRE Corporation
Updated Related_Attack_Patterns
2021-06-24
(Version 3.5)
CAPEC Content TeamThe MITRE Corporation
Updated Description
2021-10-21
(Version 3.6)
CAPEC Content TeamThe MITRE Corporation
Updated Execution_Flow
Previous Entry Names
Change DatePrevious Entry Name
2015-12-07
(Version 2.8)
Try All Common Application Switches and Options
More information is available — Please select a different filter.
Page Last Updated or Reviewed: July 31, 2018
 

Use of the Common Attack Pattern Enumeration and Classification (CAPEC), and the associated references from this website are subject to the Terms of Use. Copyright © 2007–2025, The MITRE Corporation. CAPEC and the CAPEC logo are trademarks of The MITRE Corporation.