Map 1
Elevation of Privilege
  CAPEC-5: Blue Boxing
  CAPEC-21: Exploitation of Trusted Identifiers
    CAPEC-196: Session Credential Falsification through Forging
      CAPEC-226: Session Credential Falsification through Manipulation
      CAPEC-59: Session Credential Falsification through Prediction
    CAPEC-510: SaaS User Request Forgery
    CAPEC-593: Session Hijacking
      CAPEC-102: Session Sidejacking
      CAPEC-107: Cross Site Tracing
      CAPEC-60: Reusing Session IDs
(aka Session Replay)
      CAPEC-61: Session Fixation
    CAPEC-62: Cross Site Request Forgery
      CAPEC-467: Cross Site Identification
  CAPEC-114: Authentication Abuse
    CAPEC-629: Unauthorized Use of Device Resources
    CAPEC-90: Reflection Attack in Authentication Protocol
  CAPEC-115: Authentication Bypass
    CAPEC-461: Web Services API Signature Forgery Leveraging Hash Function Extension Weakness
    CAPEC-480: Escaping Virtualization
      CAPEC-237: Escaping a Sandbox by Calling Code in Another Language
    CAPEC-664: Server Side Request Forgery
    CAPEC-668: Key Negotiation of Bluetooth Attack (KNOB)
    CAPEC-87: Forceful Browsing
  CAPEC-22: Exploiting Trust in Client
    CAPEC-202: Create Malicious Client
    CAPEC-207: Removing Important Client Functionality
      CAPEC-200: Removal of filters: Input filters, output filters, data masking
      CAPEC-208: Removing/short-circuiting 'Purse' logic: removing/mutating 'cash' decrements
    CAPEC-39: Manipulating Opaque Client-based Data Tokens
      CAPEC-31: Accessing/Intercepting/Modifying HTTP Cookies
    CAPEC-77: Manipulating User-Controlled Variables
      CAPEC-13: Subverting Environment Variable Values
      CAPEC-162: Manipulating Hidden Fields
  CAPEC-94: Adversary in the Middle
(AiTM)
    CAPEC-219: XML Routing Detour Attacks
    CAPEC-384: Application API Message Manipulation via Man-in-the-Middle
      CAPEC-385: Transaction or Event Tampering via Application API Manipulation
      CAPEC-389: Content Spoofing Via Application API Manipulation
    CAPEC-386: Application API Navigation Remapping
      CAPEC-387: Navigation Remapping To Propagate Malicious Content
      CAPEC-388: Application API Button Hijacking
    CAPEC-466: Leveraging Active Adversary in the Middle Attacks to Bypass Same Origin Policy
    CAPEC-662: Adversary in the Browser (AiTB)
  CAPEC-122: Privilege Abuse
    CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
      CAPEC-58: Restful Privilege Elevation
      CAPEC-679: Exploitation of Improperly Configured or Implemented Memory Protections
      CAPEC-680: Exploitation of Improperly Controlled Registers
      CAPEC-681: Exploitation of Improperly Controlled Hardware Security Identifiers
      CAPEC-36: Using Unpublished Interfaces
      CAPEC-121: Exploit Non-Production Interfaces
        CAPEC-661: Root/Jailbreak Detection Evasion via Debugging
    CAPEC-17: Using Malicious Files
      CAPEC-177: Create files with the same name as files protected with a higher classification
      CAPEC-263: Force Use of Corrupted Files
      CAPEC-562: Modify Shared File
      CAPEC-563: Add Malicious File to Shared Webroot
      CAPEC-642: Replace Binaries
      CAPEC-650: Upload a Web Shell to a Web Server
      CAPEC-35: Leveraging Executable Code in Non-Executable Files
    CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
    CAPEC-221: Data Serialization External Entities Blowup
    CAPEC-503: WebView Exposure
  CAPEC-233: Privilege Escalation
    CAPEC-104: Cross Zone Scripting
    CAPEC-234: Hijacking a privileged process
    CAPEC-30: Hijacking a Privileged Thread of Execution
    CAPEC-68: Subvert Code-signing Facilities
    CAPEC-69: Target Programs with Elevated Privileges
  CAPEC-390: Bypassing Physical Security
    CAPEC-391: Bypassing Physical Locks
      CAPEC-392: Lock Bumping
      CAPEC-393: Lock Picking
      CAPEC-394: Using a Snap Gun Lock to Force a Lock
    CAPEC-395: Bypassing Electronic Locks and Access Controls
      CAPEC-397: Cloning Magnetic Strip Cards
      CAPEC-398: Magnetic Strip Card Brute Force Attacks
      CAPEC-399: Cloning RFID Cards or Chips
      CAPEC-400: RFID Chip Deactivation or Destruction
      CAPEC-626: Smudge Attack
  CAPEC-507: Physical Theft
  CAPEC-560: Use of Known Domain Credentials
    CAPEC-555: Remote Services with Stolen Credentials
    CAPEC-600: Credential Stuffing
    CAPEC-652: Use of Known Kerberos Credentials
      CAPEC-509: Kerberoasting
      CAPEC-645: Use of Captured Tickets
(Pass The Ticket)
    CAPEC-653: Use of Known Windows Credentials
      CAPEC-561: Windows Admin Shares with Stolen Credentials
      CAPEC-644: Use of Captured Hashes
(Pass The Hash)
  Password Abuse
    CAPEC-50: Password Recovery Exploitation
    CAPEC-16: Dictionary Based Password Attack
    CAPEC-49: Password Brute Forcing
      CAPEC-565: Password Spraying
    CAPEC-70 Try Common or Default Usernames and Passwords
    CAPEC-55: Rainbow Table Password Cracking
  Encryption Abuse
    CAPEC-112: Brute Force
    CAPEC-20: Encryption Brute Forcing
  CAPEC-549: Local Code Execution
    CAPEC-542: Targeted Malware
      CAPEC-550: Install New Service
      CAPEC-551: Modify Existing Service
      CAPEC-552: Install Rootkit
      CAPEC-556: Replace File Extension Handlers
      CAPEC-558: Replace Trusted Executable
      CAPEC-564: Run Software at Login
      CAPEC-579: Replace Winlogon Helper DLL
  CAPEC-248: Command Injection
    CAPEC-136 LDAP Injection
    CAPEC-66 SQL Injection
      CAPEC-7: Blind SQL Injection
      CAPEC-109: Object Relational Mapping Injection
      CAPEC-110: SQL Injection through SOAP Parameter Tampering
      CAPEC-108: Command Line Execution through SQL Injection
      CAPEC-470: Expanding Control over the Operating System from the Database
    CAPEC-88 OS Command Injection
    CAPEC-183 IMAP/SMTP Command Injection
    CAPEC-250 XML Injection
      CAPEC-83: XPath Injection
      CAPEC-84: XQuery Injection
      CAPEC-228: DTD Injection
    CAPEC-676 NoSQL Injection
    CAPEC-40 Manipulating Writeable Terminal Devices
    CAPEC-137: Parameter Injection
      CAPEC-6: Argument Injection
      CAPEC-15: Command Delimiters
        CAPEC-460: HTTP Parameter Pollution
(HPP)
      CAPEC-134: Email Injection
      CAPEC-135: Format String Injection
      CAPEC-138: Reflection Injection
      CAPEC-182: Flash Injection
        CAPEC-174: Flash Parameter Injection
        CAPEC-178: Cross-Site Flashing
    CAPEC-175: Code Inclusion
      CAPEC-251: Local Code Inclusion
        CAPEC-252: PHP Local File Inclusion
        CAPEC-640: Inclusion of Code in Existing Process
        CAPEC-660: Root/Jailbreak Detection Evasion via Hooking
      CAPEC-253: Remote Code Inclusion
        CAPEC-101: Server Side Include (SSI) Injection
        CAPEC-193: PHP Remote File Inclusion
        CAPEC-500: WebView Injection
  CAPEC-242: Code Injection
    CAPEC-19: Embedding Scripts within Scripts
    CAPEC-23: File Content Injection
      CAPEC-44: Overflow Binary Resource File
    CAPEC-41: Using Meta-Characters in E-mail Headers to Inject Malicious Payloads
    CAPEC-63: Cross-site Scripting (XSS)
      CAPEC-588: DOM-Based XSS
        CAPEC-18: XSS Through Non-Script Elements
        CAPEC-32: XSS Through HTTP Query String
        CAPEC-86: XSS Through HTTP Headers
        CAPEC-198: XSS Targeting Error Pages
        CAPEC-199: XSS Using Alternate Syntax
        CAPEC-243: XSS Targeting HTML Attributes
        CAPEC-244: XSS Targeting URI Placeholders
        CAPEC-245: XSS Using Doubled Characters
        CAPEC-247: XSS Using Invalid Characters
      CAPEC-591: Reflected XSS
        CAPEC-18: XSS Through Non-Script Elements
        CAPEC-32: XSS Through HTTP Query String
        CAPEC-86: XSS Through HTTP Headers
        CAPEC-198: XSS Targeting Error Pages
        CAPEC-199: XSS Using Alternate Syntax
        CAPEC-243: XSS Targeting HTML Attributes
        CAPEC-244: XSS Targeting URI Placeholders
        CAPEC-245: XSS Using Doubled Characters
        CAPEC-247: XSS Using Invalid Characters
      CAPEC-592: Stored XSS
        CAPEC-18: XSS Through Non-Script Elements
        CAPEC-32: XSS Through HTTP Query String
        CAPEC-86: XSS Through HTTP Headers
        CAPEC-198: XSS Targeting Error Pages
        CAPEC-199: XSS Using Alternate Syntax
        CAPEC-243: XSS Targeting HTML Attributes
        CAPEC-244: XSS Targeting URI Placeholders
        CAPEC-245: XSS Using Doubled Characters
        CAPEC-247: XSS Using Invalid Characters
        CAPEC-209: XSS Using MIME Type Mismatch
    CAPEC-468: Generic Cross-Browser Cross-Domain Theft
  CAPEC-240: Resource Injection
    CAPEC-610: Cellular Data Injection
  CAPEC-586: Object Injection
  LICENSE
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.
DISCLAIMERS
ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
  This work is licensed under a Creative Commons Attribution-NoDerivatives 4.0 International License.
Brett Crawley