CAPEC-144
Detect Unpublicized Web Services
2014-06-23
00h00 +00:00
00h00 +00:00
특정 CAPEC 알림
특정 CAPEC의 변경 사항에 대한 정보를 받아보세요.
CAPEC 설명
An adversary searches a targeted web site for web services that have not been publicized. This attack can be especially dangerous since unpublished but available services may not have adequate security controls placed upon them given that an administrator may believe they are unreachable.
CAPEC 정보
실행 흐름
1) Explore
[Find target web site] An adversary finds a target web site that they think may have unpublicized web services
2) Explore
[Map the published web site] The adversary will map the published web site either by using an automated tool or by manually accessing well-known debugging or logging pages, or otherwise predictable pages within the site tree
기법
- Use Dirbuster to brute force directories and file names to find unpublicized web services
- Find a pattern in the naming of documents and extrapolate this pattern to discover additional documents that have been created but are no longer externally linked
3) Experiment
[Try to find weaknesses or information] The adversary will try to find weaknesses in the unpublicized services that the targeted site did not intend to be public
기법
- Use Nikto to look for web service vulnerabilities
4) Exploit
[Follow-up attack] Use any information or weaknesses found to carry out a follow-up attack
사전 조건
The targeted web site must include unpublished services within its web tree. The nature of these services determines the severity of this attack.필요 리소스
Spidering tools to explore the target web site are extremely useful in this attack especially when attacking large sites. Some tools might also be able to automatically construct common service queries from known paths.관련 약점
| 약점 이름 | |
|---|---|
CWE-425 |
Direct Request The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files. |
제출
| 이름 | 조직 | 날짜 | 출시일 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
수정 사항
| 이름 | 조직 | 날짜 | 댓글 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Execution_Flow | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses |
