COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-144

Detect Unpublicized Web Services

An adversary searches a targeted web site for web services that have not been publicized. This attack can be especially dangerous since unpublished but available services may not have adequate security controls placed upon them given that an administrator may believe they are unreachable.

Soyutlama

Detailed

Tipik ciddiyet

Low

Saldırı ihtimali

Medium

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary searches a targeted web site for web services that have not been publicized. This attack can be especially dangerous since unpublished but available services may not have adequate security controls placed upon them given that an administrator may believe they are unreachable.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Find target web site

An adversary finds a target web site that they think may have unpublicized web services

Map the published web site

The adversary will map the published web site either by using an automated tool or by manually accessing well-known debugging or logging pages, or otherwise predictable pages within the site tree

Kullanılan teknikler

  • Use Dirbuster to brute force directories and file names to find unpublicized web services
  • Find a pattern in the naming of documents and extrapolate this pattern to discover additional documents that have been created but are no longer externally linked
2

Experiment

Try to find weaknesses or information

The adversary will try to find weaknesses in the unpublicized services that the targeted site did not intend to be public

Kullanılan teknikler

  • Use Nikto to look for web service vulnerabilities
3

Exploit

Follow-up attack

Use any information or weaknesses found to carry out a follow-up attack

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The targeted web site must include unpublished services within its web tree. The nature of these services determines the severity of this attack.

Gerekli beceri

MITRE kaydında belirtilmemiş.

Gerekli kaynak

  • Spidering tools to explore the target web site are extremely useful in this attack especially when attacking large sites. Some tools might also be able to automatically construct common service queries from known paths.