0dayinc/pwn/capec

CAPEC exhaustive testing

Use when the ask names a CAPEC ID, an ATT&CK technique that maps to CAPEC, or "execute this attack pattern". Pair with the cwe skill: CAPEC is how the attack is performed; CWE is the weakness you prove.

When to use

• "CAPEC-66", "attack pattern", "how would an attacker XSS this"
• Purple-team / red-team playbooks that need a numbered flow
• Coverage pass: every CAPEC that applies to this stack

Methodologies

How to look up a CAPEC

Each CAPEC number is a file in this skill:

references/CAPEC-<id>.md

Examples: references/CAPEC-66.md, references/CAPEC-1.md. Open that file and follow its procedure end-to-end, including every related CWE via ../cwe/references/CWE-<id>.md. references/INDEX.md lists every ID.

Exhaustive catalog procedure

1. Identify the target class (web, API, native, firmware, human, network).
2. Pick a CAPEC view (CAPEC-1000 Mechanisms of Attack, etc.).
3. For every applicable member, run references/CAPEC-<id>.md.
4. Record N/A with a reason when prerequisites cannot be met.
5. Findings cite the member CAPEC and related CWE IDs.
6. Re-read saved evidence before calling the pattern tested.

Tooling

• Always: skills_recall this skill, then read the CAPEC reference.
• Then: skills_recall cwe for related weakness procedures.
• HTTP: PWN::Plugins::BurpSuite or TransparentBrowser.
• Source: PWN::SAST::Factory.start / pwn_sast.
• Authz: PWN::Bounty::LifecycleAuthzReplay.

Pitfalls

• Categories and views are groupings; they are not attacks.
• Skipping the related CWE procedure leaves the weakness unproven.
• One blocked payload is not an exhaustive CAPEC test.
• Do not skip deprecated IDs without following the replacement.

Verification

A CAPEC is done when its reference checklist is ticked, related CWE files were run, and evidence paths were re-read.

Catalog size (CAPEC 3.9)

• Attack patterns: 615
• Categories: 78
• Views: 13

Full table: references/INDEX.md.