Clerkendweller: /* Indicative Diagram */

2018-02-16T15:08:49Z

‎Indicative Diagram

Clerkendweller: /* Cross-References */

2018-02-16T11:49:25Z

‎Cross-References

Clerkendweller: New page

2018-02-16T10:45:31Z

New page

New page

__NOTOC__

This is an automated threat. To view all automated threats, please see the [[:Category:Automated Threat|Automated Threat Category]] page. The OWASP Automated Threat Handbook - Wed Applications ([https://www.owasp.org/index.php/File:Automated-threat-handbook.pdf pdf], print), an output of the [[OWASP Automated Threats to Web Applications|OWASP Automated Threats to Web Applications Project]], provides a fuller guide to each threat, detection methods and countermeasures. The [https://www.owasp.org/index.php/File:Oat-ontology-decision-chart.pdf threat identification chart] helps to correctly identify the automated threat.

== Definition ==

===OWASP Automated Threat (OAT) Identity Number ===

OAT-010

===Threat Event Name===

Card Cracking

=== Summary Defining Characteristics===

Identify missing start/expiry dates and security codes for stolen payment card data by trying different values.

===Indicative Diagram===

=== Description ===

Brute force attack against application payment card processes to identify the missing values for start date, expiry date and/or card security code (CSC), also referred to in many ways, including card validation number 2 (CVN2), card validation code (CVC), card verification value (CV2) and card identification number (CID).

When these values are known as well as the Primary Account Number (PAN), [[OAT-001 Carding]] is used to validate the details, and [[OAT-012 Cashing Out]] to obtain goods or cash.

=== Other Names and Examples ===

Brute forcing credit card information; Card brute forcing; Credit card cracking; Distributed guessing attack

=== See Also ===

* [[OAT-001 Carding]]
* [[OAT-012 Cashing Out]]

== Cross-References ==

=== CAPEC Category / Attack Pattern IDs ===

* 112 Brute Force
* 210 Abuse of Functionality

=== CWE Base / Class / Variant IDS ===

* 799 Improper Control of Interaction Frequency
* 837 Improper Enforcement of a Single, Unique Action

=== WASC Threat IDS ===

* 11 Brute Force
* 21 Insufficient Anti-Automation
* 42 Abuse of Functionality

=== OWASP Attack Category / Attack IDs ===

* [[:Category:Abuse of Functionality|Abuse of Functionality]]
* [[Brute force attack|Brute Force Attack]]

[[Category: Automated Threat]]

@@ Line 19: / Line 19: @@
 ===Indicative Diagram===
+[[File:OAT-010_Card_Cracking.png|500px|link=]]
 === Description ===

@@ Line 43: / Line 43: @@
 * 210 Abuse of Functionality
-=== CWE Base / Class / Variant IDS ===
+=== CWE Base / Class / Variant IDs ===
 * 799 Improper Control of Interaction Frequency
 * 837 Improper Enforcement of a Single, Unique Action
-=== WASC Threat IDS ===
+=== WASC Threat IDs ===
 * 11 Brute Force

OAT-010 Card Cracking - Revision history

Clerkendweller: /* Indicative Diagram */

Clerkendweller: /* Cross-References */

Clerkendweller: New page