Detect Unpublicized Web Pages

An adversary searches a targeted web site for web pages that have not been publicized. In doing this, the adversary may be able to gain access to information that the targeted site did not intend to make public.

Abstraction

Detailed

Typical severity

Low

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

Execution flow

How does the attack proceed, step by step?

Explore

Find target web site

An adversary finds a target web site that they think may have unpublicized web pages

Map the published web site

The adversary will map the published web site either by using an automated tool or by manually accessing well-known debugging or logging pages, or otherwise predictable pages within the site tree

Techniques used

Use Dirbuster to brute force directories and file names to find unpublicized pages
Find a pattern in the naming of documents and extrapolate this pattern to discover additional documents that have been created but are no longer externally linked

Experiment

Try to find weaknesses or information

The adversary will try to find weaknesses or information on the unpublicized pages that the targeted site did not intend to be public

Techniques used

Manually analyze files or pages for information that could be useful in a further attack
Use a static analysis tool to find weaknesses in unpublished web pages

Exploit

Follow-up attack

Use any information or weaknesses found to carry out a follow-up attack

Requirements

What does the attack require?

Prerequisites

The targeted web site must include pages within its published tree that are not connected to its tree of links. The sensitivity of the content of these pages determines the severity of this attack.

Skills required

Not stated in the MITRE record.

Resources required

Spidering tools to explore the target web site are extremely useful in this attack especially when attacking large sites. Some tools might also be able to automatically construct common page locations from known paths.