Offensive Security

Question 1

What does CAPEC stand for ?

Answer 1

Common Attack Pattern Enumeration and Classification

Question 2

What is CAPEC ?

Answer 2

Collection of 500+ attack patterns and techniques

• Related to CWEs (Common Weakness Enumeration)
• Link attack (CAPEC-ID) to vulnerability (CWE-ID)

Question 3

What is CAPEC useful for ?

Answer 3

Helps in understanding attacks and attackers’ mindset

• Helps in choosing preventive measures
• Design application
• Configure environment

Question 4

Which categories of attack mechanisms exist in CAPEC ?

Answer 4

• Planning of attacks, collection of information
• Input handling
• Deceptive interactions, spoofing [authenticity]
• Injection [integrity]
• Abuse of existing functionality [availability]
• Probabilistic techniques: brute force/fuzzing
• Subversion of access control
• Manipulation of data structures (internal state)
• Manipulation of timing and state; race conditions
• Manipulation of system resources (environment)

Question 5

What are possible Attack vectors ?

Answer 5

• Code (transition function)
• Internal state
• Input
• User (provides code, input)

Question 6

What is Fuzzing ?

Answer 6

• Providing random input to program

- Observing how input leads to changes in control flow

Question 7

What are the most likely results of fuzzing ?

Answer 7

• Program does not accept input
• Program crashes (-> availability; integrity)
• Program reveals data (-> confidentiality)
• Exception is thrown, security mechanisms are bypassed

Question 8

What is reverse engeneering ?

Answer 8

Reverse engineering: find out rules of a machine/program by looking
only at machine/program and its behaviour without access to sourcecode

Question 9

Where is the main difference between fuzzing and reverse engeneering ?

Answer 9

More systematic than fuzzing, uncover code paths that are hard (i.e.
unlikely) to trigger by random input

Insight into program behaviour

Question 10

Which tools are used in reverse engeneering ?

Answer 10

• Decompiler
• Disassembler
• Debugger
• Virtual machine

Question 11

What does a decompiler do ?

Answer 11

• Tool that converts machine code into source code

- Original names of methods, parameters, variables often not retrievable from binary

Question 12

what does a dissassembler do ?

Answer 12

• Tool that converts machine code (machine-readable) into assembly
  language (human-readable)
• Reveal control flow, call graphs, code patterns

Question 13

what does a debugger do ?

Answer 13

• Tool that attaches to and controls processes

- Breakpoints, step-wise execution, internal state (memory)

Question 14

what does a virtual machine do ?

Answer 14

• Similar to program execution by debugger

- Observe program behaviour during controlled execution