CAPEC™ 54: Query System for Information
Description
An adversary, aware of an application's location (and possibly authorized to use the application), probes an application's structure and evaluates its robustness by submitting requests and examining responses. Often, this is accomplished by sending variants of expected queries in the hope that these modified queries might return information beyond what the expected set of queries would provide.
Source: CAPEC™ 54
Related ASVS Requirements
ASVS (5.0): 10.2.3, 11.2.5, 13.2.2, 13.4.1, 13.4.2, 13.4.3, 13.4.4, 13.4.5, 13.4.6, 13.4.7, 15.2.3, 16.2.5, 16.3.2, 16.3.3, 16.4.2, 16.5.1, 16.5.3, 17.1.1, 4.3.2, 8.1.1
