CAPEC: how an attack exploits a weakness

What an attack pattern is for

CAPEC provides a common vocabulary to describe how an attack works, regardless of the product targeted. Each entry gives the attacker's prerequisites, the execution steps, the skills required, the weaknesses exploited and the known countermeasures.

For a defensive team, it is a threat modeling tool: every weakness identified in your code maps to documented attack patterns, and therefore to defenses you can identify without having to invent them.

A pattern step by step: CAPEC-66, SQL injection

A CAPEC entry reads like a playbook. Here is CAPEC-66 summarized in four steps:

1. Explore. The attacker sends a single quote in every form field and watches the error messages. An SQL syntax error shown on screen is already an answer.
2. Probe. They inject an always-true condition to see whether the query behaves differently, then measure response times when no message appears.
3. Exploit. They chain a second query to extract the database structure, then its contents.
4. Persist. Depending on the database account's privileges, they write a file to the server or create an application account.

The weakness exploited is CWE-89. The countermeasures listed in the entry are standard and effective: prepared statements, strict input validation, a least-privilege database account, error messages that reveal nothing to the client. That continuity — from the attacker's move to the line of code you need to write — is what makes the catalog valuable.

A few common patterns

The full catalog has more than 600 patterns. It is published by MITRE at capec.mitre.org.

Three levels of abstraction

Patterns exist at several scales, and mixing up the levels is the main source of misunderstanding:

• Meta: a general strategy, for example “inject.” Useful for framing a threat modeling workshop.
• Standard: an identifiable technique, for example SQL injection. This is the level you can work with day to day.
• Detailed: a precise implementation, linked to specific CWEs. This is the penetration testing level.

Start general and work down to the specifics: a workshop that starts at the Detailed level gets lost in edge cases before covering the major families.

CAPEC or MITRE ATT&CK?

Both catalogs come from the same publisher and are often confused. They describe different moments:

A development team works with CAPEC; a security operations center works with ATT&CK. The two meet at initial access, which is the last chapter of the former and the first chapter of the latter.

What it means for you, in practice

CAPEC is not a catalog to monitor day to day — it does not change much. It is useful at two moments: when you design a sensitive feature (authentication, file upload, a call to a third-party service), by listing the known patterns that target it; and when you write the scope for a penetration test, by naming the patterns to cover instead of asking for “a pentest.”