CWE-200: Exposure of Sensitive Information

Step-by-step: how CWE-200 gets exploited

A stage-by-stage walkthrough of the attack, mapped to the real MITRE ATT&CK tactics for this weakness — what the attacker is trying to do, what's at risk (what can be stolen or damaged), and how you defend. Understanding the playbook is how you shut it down.

1. 1
   Reconnaissancereconnaissance

   Study the target to find the weakness before touching it.

   At risk / what's stolen

   Exposed version info, error messages, and endpoints that reveal the vulnerable component.

   How you defend

   Minimise information disclosure; hide version banners and verbose errors.

2. 2
   Executionexecution

   Run attacker-chosen code or commands on the system.

   At risk / what's stolen

   Application logic and the host runtime — an attacker can execute arbitrary code or commands.

   How you defend

   Least-privilege runtime, sandboxing, and safe deserialization/parsing.

3. 3
   Privilege escalationprivilege-escalation

   Gain higher privileges — from a limited account to admin/root.

   At risk / what's stolen

   Over-permissioned services, weak file/permission boundaries, and setuid paths.

   How you defend

   Drop privileges, enforce least privilege, and lock down file permissions.

4. 4
   Credential accesscredential-access

   Steal passwords, tokens, keys, and session material.

   At risk / what's stolen

   Passwords, API keys, session tokens, SSH/TLS keys, and secrets in memory, env, or config.

   How you defend

   Secret managers, short-lived tokens, and no secrets in code/env/logs.

5. 5
   Discoverydiscovery

   Map what else is reachable — hosts, services, data stores, and accounts.

   At risk / what's stolen

   Internal topology, service inventory, and data locations the attacker enumerates.

   How you defend

   Network segmentation and detection of unusual internal scanning.

6. 6
   Lateral movementlateral-movement

   Pivot from the compromised system to others on the network.

   At risk / what's stolen

   Adjacent servers, databases, and internal services reachable from the foothold.

   How you defend

   Segmentation, per-service auth, and blocking reused credentials across systems.

7. 7
   Collectioncollection

   Gather the valuable data before taking it out.

   At risk / what's stolen

   Databases, files, customer records, source code, and business data.

   How you defend

   Data-access monitoring, encryption at rest, and least-privilege data access.

This is a defensive, conceptual walkthrough for education — stages reflect MITRE ATT&CK tactics associated with this weakness class, not a working exploit. Not every attack uses every stage.