CAPEC-591 Detail

Execution Flow

1) Explore

[Survey the application for user-controllable inputs] Using a browser or an automated tool, an adversary follows all public links and actions on a web site. They record all the links, the forms, the resources accessed and all other potential entry-points for the web application.

Technique

• Use a spidering tool to follow and record all links and analyze the web pages to find entry points. Make special note of any links that include parameters in the URL.
• Use a proxy tool to record all links visited during a manual traversal of the web application.
• Use a browser to manually explore the website and analyze how it is constructed. Many browsers' plugins are available to facilitate the analysis or automate the discovery.

2) Experiment

[Probe identified potential entry points for reflected XSS vulnerability] The adversary uses the entry points gathered in the "Explore" phase as a target list and injects various common script payloads and special characters to determine if an entry point actually represents a vulnerability and to characterize the extent to which the vulnerability can be exploited.

Technique

• Use a list of XSS probe strings to inject script in parameters of known URLs. If possible, the probe strings contain a unique identifier.
• Use a proxy tool to record results of manual input of XSS probes in known URLs.
• Use a list of HTML special characters to inject into parameters of known URLs and check if they were properly encoded, replaced, or filtered out.

3) Experiment

[Craft malicious XSS URL] Once the adversary has determined which parameters are vulnerable to XSS, they will craft a malicious URL containing the XSS exploit. The adversary can have many goals, from stealing session IDs, cookies, credentials, and page content from the victim.

Technique

• Change a URL parameter to include a malicious script tag.
• Send information gathered from the malicious script to a remote endpoint.

4) Exploit

[Get victim to click URL] In order for the attack to be successful, the victim needs to access the malicious URL.

Technique

• Send a phishing email to the victim containing the malicious URL. This can be hidden in a hyperlink as to not show the full URL, which might draw suspicion.
• Put the malicious URL on a public forum, where many victims might accidentally click the link.

Prerequisites

Skills Required

Resources Required

Mitigations

Related Weaknesses

References

REF-476

REF-604

Submission

Modifications