757
CAPEC-ID Attack Pattern Name
49 Password Brute Forcing
55 Rainbow Table Password Cracking
70 Try Common or Default Usernames and Passwords
509 Kerberoasting
555 Remote Services with Stolen Credentials
560 Use of Known Domain Credentials
561 Windows Admin Shares with Stolen Credentials
565 Password Spraying
600 Credential Stuffing
652 Use of Known Kerberos Credentials
653 Use of Known Operating System Credentials
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-311: Missing Encryption of Sensitive Data
Weakness ID : 311
Structure : Simple
Abstraction : Class
Description
The product does not encrypt sensitive or critical information before storage or transmission.
Extended Description
The lack of proper data encryption passes up the guarantees of confidentiality, integrity, and
accountability that properly implemented encryption conveys.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 693 Protection Mechanism Failure 1520
ParentOf 312 Cleartext Storage of Sensitive Information 764
ParentOf 319 Cleartext Transmission of Sensitive Information 779
PeerOf 327 Use of a Broken or Risky Cryptographic Algorithm 799
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ParentOf 312 Cleartext Storage of Sensitive Information 764
ParentOf 319 Cleartext Transmission of Sensitive Information 779
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1013 Encrypt Data 2428
Applicable Platforms
CWE Version 4.14
CWE-311: Missing Encryption of Sensitive Data
CWE-311: Missing Encryption of Sensitive Data