| Name |
Detect Unpublicized Web Services |
|
| Likelyhood of attack |
Typical severity |
| High |
Low |
|
| Summary |
An adversary searches a targeted web site for web services that have not been publicized. This attack can be especially dangerous since unpublished but available services may not have adequate security controls placed upon them given that an administrator may believe they are unreachable. |
| Prerequisites |
The targeted web site must include unpublished services within its web tree. The nature of these services determines the severity of this attack. |
| Execution Flow |
| Step |
Phase |
Description |
Techniques |
| 1 |
Explore |
[Find target web site] An adversary finds a target web site that they think may have unpublicized web services |
|
| 2 |
Explore |
[Map the published web site] The adversary will map the published web site either by using an automated tool or by manually accessing well-known debugging or logging pages, or otherwise predictable pages within the site tree |
- Use Dirbuster to brute force directories and file names to find unpublicized web services
- Find a pattern in the naming of documents and extrapolate this pattern to discover additional documents that have been created but are no longer externally linked
|
| 3 |
Experiment |
[Try to find weaknesses or information] The adversary will try to find weaknesses in the unpublicized services that the targeted site did not intend to be public |
- Use Nikto to look for web service vulnerabilities
|
| 4 |
Exploit |
[Follow-up attack] Use any information or weaknesses found to carry out a follow-up attack |
|
|
| Solutions | |
| Related Weaknesses |
|
CWE ID
|
Description
|
| CWE-425 |
Direct Request ('Forced Browsing') |
|
| Related CAPECS |
|
CAPEC ID
|
Description
|
| CAPEC-150 |
An adversary exploits well-known locations for resources for the purposes of undermining the security of the target. In many, if not most systems, files and resources are organized in a default tree structure. This can be useful for adversaries because they often know where to look for resources or files that are necessary for attacks. Even when the precise location of a targeted resource may not be known, naming conventions may indicate a small area of the target machine's file tree where the resources are typically located. For example, configuration files are normally stored in the /etc director on Unix systems. Adversaries can take advantage of this to commit other types of attacks. |
|