| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | M | 113 | Interface Manipulation |
Identify API
Discover an API of interest by exploring application documentation or observing responses to API calls
| Technique |
|---|
| Search via internet for known, published APIs that support scripting instructions as arguments |
Test simple script
Adversaries will attempt to give a smaller script as input to the API, such as simply printing to the console, to see if the attack is viable.
| Technique |
|---|
| Create a general script to be taken as input by the API |
Give malicious scripting instructions to API
Adversaries will now craft custom scripts to do malicious behavior. Depending on the setup of the application this script could be run with user or admin level priveleges.
| Technique |
|---|
| Crafting a malicious script to be run on a system based on priveleges and capabilities of the system |
| Scope | Likelihood | Impact | Note |
|---|
| Taxonomy Name | Entry ID | Entry Name |
|---|