Credential, session, recovery and privilege abuse
V07 · reusable vector · version 1.0MED · proposed test impact
An adversary uses a stolen, weak or wrongly privileged identity/session, or a defective recovery process, to cross an access boundary.
Attacker tools and payload types
A credential, session token, recovery instruction or privileged request may be sufficient; malware is not always involved. Use client test identities only.
The entries below are tools that can support assessment or emulate aspects of this vector in an authorised fixture. They are not claims that these exact products were used in every linked incident. Native platform availability and Armory installation are different from tested capability.
- burpsuite · Armory · Existing local tool notes · Maintained official user guide
- BloodHound (AD Attack Paths) · Armory · Existing local tool notes · Upstream project / documentation
Repository and operating guides
identity-tests.csv · RES-012 · published synthetic fixture in the assessment collection linked from the Repository.
Account Takeover/mfa-bypass.md · existing Repository reference; choose only relevant approved checks.
Methodology and Resources/Active Directory Attack.md · existing Repository reference; choose only relevant approved checks.
Read the selected tool’s guide for installation and operation rather than recreating it here. Pin the deployed version and reviewed configuration in the task record. Some local guides are autogenerated inventory notes and contain stale commands or broad prerequisite lists; they require validation before use. The official manuals linked above were checked during this review.
Reusable controlled test
Review permissions and recovery, then test allowed/denied roles, MFA, revocation and bounded synthetic password controls. Do not guess real staff passwords.
- Required permission
- Named identities and actions, explicit recovery permission, attempt limits and data scope; contacting helpdesk requires V01 permission too.
- Parent supplies
- Scenario/risk ID; business question; exact targets; named permitted people; channel; current policy revision; tool/resource versions; limits; expected result and reviewer.
- Output
- One result per approved case, with run and target IDs, permission decision, evidence, actual outcome and coverage limits.
- Measure
- Correct access/recovery decisions / executed cases; revocation behaviour; coverage by identity class. No client result has been collected here.
- Failure handling
- Blocked, not authorised, failed, inconclusive and not tested remain visible. A refused route cannot be replaced by another agent, channel or target without fresh applicable approval.
What the vector returns to the scenario
| Result | What it means |
|---|---|
| Control held | The evidenced attempted action was prevented under the tested conditions. This is not a universal security guarantee. |
| Control failed | Describe the exact observed boundary failure and its business consequence, without inflating it into a wider compromise. |
| Unknown / not tested | Record the missing capability, evidence, permission or coverage. Do not invent a score. |
Mitigation recommendations
Reduce likelihood: Strengthen authentication and recovery, limit standing privilege and protect sessions.
Reduce impact: Constrain access to sensitive data/actions and respond promptly to abnormal identity events.
Define how a later retest would verify the recommendation; implementation assignments, scheduling and pricing are Part 2.
Used by these scenarios
- When a cyberattack spoils the stock
- A convincing support request opens the customer database
- The invoice is plausible. The bank account is wrong.
- An overlooked web page exposes customer records
- A cloud permission error becomes a data breach
- Guest connectivity becomes an internal-network route
- The business stops when supporting IT stops
- A supplier outage interrupts essential services
- A phone compromise exposes confidential work
- An AI assistant treats hostile content as an instruction
- A lost device or physical-access gap exposes useful information