Frameworks & standards
CAPEC
Common Attack Pattern Enumeration and Classification
Common Attack Pattern Enumeration and Classification (CAPEC) is a MITRE-maintained catalog of the attack patterns adversaries use to exploit weaknesses - for example CAPEC-66 (SQL Injection). CAPEC describes how weaknesses (CWEs) are attacked, bridging weakness taxonomy and adversary behavior.
Key points
- Catalog of how weaknesses are exploited.
- Bridges CWE (weaknesses) and ATT&CK (adversary behavior).
- Referenced in vulnerability pages here.
Related
References
Impactr finds and proves whether flaws like this are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.