CAPEC-143
Detect Unpublicized Web Pages
2014-06-23
00h00 +00:00
00h00 +00:00
Cảnh báo cho một CAPEC
Luôn được thông báo về mọi thay đổi đối với một CAPEC cụ thể.
Mô tả CAPEC
An adversary searches a targeted web site for web pages that have not been publicized. In doing this, the adversary may be able to gain access to information that the targeted site did not intend to make public.
Thông tin CAPEC
Luồng thực thi
1) Explore
[Find target web site] An adversary finds a target web site that they think may have unpublicized web pages
2) Explore
[Map the published web site] The adversary will map the published web site either by using an automated tool or by manually accessing well-known debugging or logging pages, or otherwise predictable pages within the site tree
Kỹ thuật
- Use Dirbuster to brute force directories and file names to find unpublicized pages
- Find a pattern in the naming of documents and extrapolate this pattern to discover additional documents that have been created but are no longer externally linked
3) Experiment
[Try to find weaknesses or information] The adversary will try to find weaknesses or information on the unpublicized pages that the targeted site did not intend to be public
Kỹ thuật
- Manually analyze files or pages for information that could be useful in a further attack
- Use a static analysis tool to find weaknesses in unpublished web pages
4) Exploit
[Follow-up attack] Use any information or weaknesses found to carry out a follow-up attack
Điều kiện tiên quyết
The targeted web site must include pages within its published tree that are not connected to its tree of links. The sensitivity of the content of these pages determines the severity of this attack.Tài nguyên cần thiết
Spidering tools to explore the target web site are extremely useful in this attack especially when attacking large sites. Some tools might also be able to automatically construct common page locations from known paths.Điểm yếu liên quan
| Tên điểm yếu | |
|---|---|
CWE-425 |
Direct Request The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files. |
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Execution_Flow | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses |
