Clerkendweller: /* Indicative Diagram */

2018-02-16T15:04:59Z

‎Indicative Diagram

Clerkendweller: /* Cross-References */

2018-02-16T11:47:12Z

‎Cross-References

Clerkendweller: New page

2018-02-16T10:10:33Z

New page

New page

__NOTOC__

This is an automated threat. To view all automated threats, please see the [[:Category:Automated Threat|Automated Threat Category]] page. The OWASP Automated Threat Handbook - Wed Applications ([https://www.owasp.org/index.php/File:Automated-threat-handbook.pdf pdf], print), an output of the [[OWASP Automated Threats to Web Applications|OWASP Automated Threats to Web Applications Project]], provides a fuller guide to each threat, detection methods and countermeasures. The [https://www.owasp.org/index.php/File:Oat-ontology-decision-chart.pdf threat identification chart] helps to correctly identify the automated threat.

== Definition ==

===OWASP Automated Threat (OAT) Identity Number ===

OAT-004

===Threat Event Name===

Fingerprinting

=== Summary Defining Characteristics===

Elicit information about the supporting so ware and framework types and versions.

===Indicative Diagram===

=== Description ===

Specific requests are sent to the application eliciting information in order to profile the application. This probing typically examines HTTP header names and values, session identifier names and formats, contents of error page messages, URL path case sensitivity, URL path patterns, file extensions, and whether software-specific files and directories exist. Fingerprinting is often reliant on information leakage and this profiling may also reveal some network architecture/topology. The fingerprinting may be undertaken without any direct usage of the application, e.g. by querying a store of exposed application properties such as held in a search engine's index.

Fingerprinting seeks to identity application components, whereas [[OAT-018 Footprinting]] is a more detailed analysis of how the application works.

=== Other Names and Examples ===

Google dorking; Google hacking; Shodaning; Target acquisition; Target scanning; Finding potentially vulnerable applications; Reconnaissance; URL harvesting; Web application fingerprinting

=== See Also ===

* [[OAT-011 Scraping]]
* [[OAT-018 Footprinting]]

== Cross-References ==

=== CAPEC Category / Attack Pattern IDs ===

* 541 Application Fingerprinting
* 170 Web Application Fingerprinting

=== CWE Base / Class / Variant IDS ===

* 200 Information Exposure

=== WASC Threat IDS ===

* 45 Fingerprinting

=== OWASP Attack Category / Attack IDs ===

* -

[[Category: Automated Threat]]

@@ Line 19: / Line 19: @@
 ===Indicative Diagram===
+[[File:OAT-004_Fingerprinting.png|500px|link=]]
 === Description ===

@@ Line 43: / Line 43: @@
 * 170 Web Application Fingerprinting
-=== CWE Base / Class / Variant IDS ===
+=== CWE Base / Class / Variant IDs ===
 * 200 Information Exposure
-=== WASC Threat IDS ===
+=== WASC Threat IDs ===
 * 45 Fingerprinting

OAT-004 Fingerprinting - Revision history

Clerkendweller: /* Indicative Diagram */

Clerkendweller: /* Cross-References */

Clerkendweller: New page