CAPEC 描述
CAPEC 資訊
執行流程
[Survey the application for stored user-controllable inputs] Using a browser or an automated tool, an adversary follows all public links and actions on a web site. They record all areas that allow a user to upload content through an HTTP POST request. This is typically found in blogs or forums.
- Use a spidering tool to follow and record all links and analyze the web pages to file upload features
- Use a proxy tool to record all links visited during a manual traversal of the web application.
- Use a browser to manually explore the website and analyze how it is constructed. Many browsers' plugins are available to facilitate the analysis or automate the discovery.
[Probe identified potential entry points for MIME type mismatch] The adversary uses the entry points gathered in the "Explore" phase as a target list and uploads files with scripting content, but whose MIME type is specified as a file type that cannot execute scripting content. If the application only checks the MIME type of the file, it may let the file through, causing the script to be executed by any user who accesses the file.
- Upload a script file with a MIME type of text/plain to a forum and then access the uploaded file to see if the script is executed. If possible, the script displays a unique identifier so the adversary knows for certain it was executed when testing.
[Store malicious XSS content] Once the adversary has determined which file upload locations are vulnerable to MIME type mismatch, they will upload a malicious script disguised as a non scripting file. The adversary can have many goals, from stealing session IDs, cookies, credentials, and page content from a victim.
- Use a tool such as BeEF to store a hook into the web application. This will alert the adversary when the victim has accessed the content and will give the adversary control over the victim's browser, allowing them access to cookies, user screenshot, user clipboard, and more complex XSS attacks.
[Get victim to view stored content] In order for the attack to be successful, the victim needs to view the stored malicious content on the webpage.
- Send a phishing email to the victim containing a URL that will direct them to the malicious stored content.
- Simply wait for a victim to view the content. This is viable in situations where content is posted to a popular public forum.
前置條件
The victim must follow a crafted link that references a scripting file that is mis-typed as a non-executable file.The victim's browser must detect the true type of a mis-labeled scripting file and invoke the appropriate script interpreter without first performing filtering on the content.
所需資源
The adversary must have the ability to source the file of the incorrect MIME type containing a script.相關弱點
| 弱點名稱 | |
|---|---|
CWE-79 |
Improper Neutralization of Input During Web Page Generation The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
CWE-20 |
Improper Input Validation The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
CWE-646 |
Reliance on File Name or Extension of Externally-Supplied File The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. |
參考資料
REF-78
OWASP Testing Guidehttp://www.owasp.org/index.php/Testing_for_Stored_Cross_site_scripting_(OWASP-DV-002)
提交
| 名稱 | 機構 | 日期 | 發布日期 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Activation_Zone, Description Summary, Examples-Instances, Injection_Vector, Payload, Payload_Activation_Impact, Related_Attack_Patterns, Related_Weaknesses, Resources_Required | |
| CAPEC Content Team | The MITRE Corporation | Updated Execution_Flow | |
| CAPEC Content Team | The MITRE Corporation | Updated Execution_Flow |
