In short
The CWE describes the flaw; CAPEC describes the method of attack that takes advantage of it. Knowing the method tells you where to place a countermeasure: you do not defend against SQL injection in the same place as session hijacking.
· 5 min read.
What an attack pattern is for
CAPEC provides a common vocabulary to describe how an attack works, regardless of the product targeted. Each entry gives the attacker's prerequisites, the execution steps, the skills required, the weaknesses exploited and the known countermeasures.
For a defensive team, it is a threat modeling tool: every weakness identified in your code maps to documented attack patterns, and therefore to defenses you can identify without having to invent them.
A pattern step by step: CAPEC-66, SQL injection
A CAPEC entry reads like a playbook. Here is CAPEC-66 summarized in four steps:
- Explore. The attacker sends a single quote in every form field and watches the error messages. An SQL syntax error shown on screen is already an answer.
- Probe. They inject an always-true condition to see whether the query behaves differently, then measure response times when no message appears.
- Exploit. They chain a second query to extract the database structure, then its contents.
- Persist. Depending on the database account's privileges, they write a file to the server or create an application account.
The weakness exploited is CWE-89. The countermeasures listed in the entry are standard and effective: prepared statements, strict input validation, a least-privilege database account, error messages that reveal nothing to the client. That continuity — from the attacker's move to the line of code you need to write — is what makes the catalog valuable.
A few common patterns
| CAPEC | Attack pattern | Weakness exploited |
|---|---|---|
CAPEC-66 | SQL injection | CWE-89 |
CAPEC-63 | Cross-site scripting | CWE-79 |
CAPEC-1 | Access control bypass | CWE-284 |
CAPEC-100 | Buffer overflow | CWE-120 |
CAPEC-242 | Code injection | CWE-94, CWE-917 |
The full catalog has more than 600 patterns. It is published by MITRE at capec.mitre.org.
Three levels of abstraction
Patterns exist at several scales, and mixing up the levels is the main source of misunderstanding:
- Meta: a general strategy, for example “inject.” Useful for framing a threat modeling workshop.
- Standard: an identifiable technique, for example SQL injection. This is the level you can work with day to day.
- Detailed: a precise implementation, linked to specific CWEs. This is the penetration testing level.
Start general and work down to the specifics: a workshop that starts at the Detailed level gets lost in edge cases before covering the major families.
CAPEC or MITRE ATT&CK?
Both catalogs come from the same publisher and are often confused. They describe different moments:
| CAPEC | MITRE ATT&CK | |
|---|---|---|
| Describes | How a weakness gets exploited | How an adversary operates once inside |
| Level | Application, vulnerability | Operational, campaign |
| Used for | Designing and coding more securely | Detecting and responding |
A development team works with CAPEC; a security operations center works with ATT&CK. The two meet at initial access, which is the last chapter of the former and the first chapter of the latter.
What it means for you, in practice
CAPEC is not a catalog to monitor day to day — it does not change much. It is useful at two moments: when you design a sensitive feature (authentication, file upload, a call to a third-party service), by listing the known patterns that target it; and when you write the scope for a penetration test, by naming the patterns to cover instead of asking for “a pentest.”
Key takeaways
- CAPEC describes the method of attack; CWE describes the flaw exploited.
- Each pattern links to the weaknesses involved and to known countermeasures.
- Three levels of abstraction: Meta, Standard, Detailed.
- Complements ATT&CK, which describes what happens after the intrusion.
FAQ
How many CAPEC patterns are there?
More than 600, covering most application, network, hardware and social engineering exploitation techniques. The catalog is published and versioned by MITRE.
Is CAPEC useful to a defensive team?
Yes, and that is actually its main use. Each entry lists the countermeasures associated with a pattern: it is a library of defenses indexed by the way you are attacked.
Should you monitor CAPEC the way you monitor CVEs?
No. CVEs arrive every day and need monitoring; CAPEC is a stable catalog you consult when designing or testing. Treating it like an alert feed wastes time and adds nothing.