| 名称 |
Establish Rogue Location |
|
| 攻击可能性 |
典型严重性 |
| Medium |
Medium |
|
| 摘要 |
An adversary provides a malicious version of a resource at a location that is similar to the expected location of a legitimate resource. After establishing the rogue location, the adversary waits for a victim to visit the location and access the malicious resource. |
| 前置条件 |
A resource is expected to available to the user. |
| 解决方案 | |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-200 |
Exposure of Sensitive Information to an Unauthorized Actor |
|
| 关联 CAPEC |
|
CAPEC 编号
|
描述
|
| CAPEC-154 |
An adversary deceives an application or user and convinces them to request a resource from an unintended location. By spoofing the location, the adversary can cause an alternate resource to be used, often one that the adversary controls and can be used to help them achieve their malicious goals. |
| CAPEC-691 |
An adversary spoofs open-source software metadata in an attempt to masquerade malicious software as popular, maintained, and trusted. |
|
| 分类体系：ATTACK |
|
条目编号
|
条目名称
|
| 1036.005 |
Masquerading: Match Legitimate Name or Location |
|