πŸ“‚ 02 - ATT&CK Collection

Overview

MITRE ATT&CK: Collection (TA0009) β€” the adversary is trying to gather data of interest to their goal.

Gathering data the attacker shouldn’t be able to read: data from information repositories (SQL/NoSQL injection), local files (LFI, path traversal), internal services (SSRF), and client-side data leaks.


🧠 Techniques

FileCreated
(incomplete) CSS InjectionMay 21, 2026
(incomplete) CVE-2026-27944May 21, 2026
(incomplete) GraphQL - IDOR via Insecure ResolversMay 21, 2026
(incomplete) GraphQL - Injection AttackMay 21, 2026
(incomplete) Local File InclusionMay 21, 2026
(incomplete) NoSQL InjectionMay 21, 2026
(incomplete) SQLi - Prepare Statement FailuresMay 26, 2026
Cross-site ScriptingMay 22, 2026
IMAP - Mailbox EnumerationSeptember 07, 2026
ORM & NoSQL InjectionMonday, April 27th 2026, 8:21:48 am
ORM Injection - PrismaMonday, April 27th 2026, 9:09:16 am
Path TraversalTuesday, March 24th 2026, 5:38:33 am
Server-side Request ForgeryMay 21, 2026
SQLi - Boolean-based BlindMonday, March 16th 2026, 10:23:16 am
SQLi - Error-basedMonday, March 16th 2026, 10:24:06 am
SQLi - Time-based BlindMonday, March 16th 2026, 10:23:40 am
SQLi - UNION-basedTuesday, February 10th 2026, 10:58:13 pm
SQLi Context - INFriday, March 20th 2026, 5:35:19 pm
SQLi Context - INSERT and UPDATEFriday, March 20th 2026, 5:20:32 pm
SQLi Context - LIKE (wildcards)Monday, March 16th 2026, 2:15:53 pm
SQLi Context - ORDER BYMonday, March 16th 2026, 10:28:30 am
SQLi Context - WHERE and HAVINGMonday, March 16th 2026, 10:27:01 am
XSS - DOM ClobberingWednesday, May 6th 2026, 7:51:54 am

πŸ“¦ Tech Stack

FileCreated
(incomplete) NginxMay 21, 2026

πŸ› οΈ Tools

FileCreated
SQLmapTuesday, February 10th 2026, 10:58:13 pm