This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Forced browsing"
(→Related Threat Agents) |
(→Related Attacks: Updated a link that was redirecting to the other link aka path manipulation redirected to path traversal) (Tag: Visual edit) |
||
(23 intermediate revisions by 5 users not shown) | |||
Line 1: | Line 1: | ||
− | |||
− | |||
− | |||
− | |||
− | |||
[[Category:OWASP ASDR Project]] | [[Category:OWASP ASDR Project]] | ||
− | |||
− | |||
==Description== | ==Description== | ||
+ | Forced browsing is an attack where the aim is to enumerate and access resources that are not referenced by the application, but are still accessible. | ||
− | + | An attacker can use [[Brute force attack|Brute Force]] techniques to search for unlinked contents in the domain directory, such as temporary directories and files, and old backup and configuration files. These resources may store sensitive information about web applications and operational systems, such as source code, credentials, internal network addressing, and so on, thus being considered a valuable resource for intruders. | |
− | |||
− | An attacker can use | ||
− | This attack | + | This attack is performed manually when the application index directories and pages are based on number generation or predictable values, or using automated tools for common files and directory names. |
This attack is also known as Predictable Resource Location, File Enumeration, Directory Enumeration, and Resource Enumeration. | This attack is also known as Predictable Resource Location, File Enumeration, Directory Enumeration, and Resource Enumeration. | ||
− | ==Risk Factors== | + | <!--==Risk Factors== |
− | TBD | + | TBD--> |
[[Category:FIXME|need content]] | [[Category:FIXME|need content]] | ||
− | |||
==Examples== | ==Examples== | ||
Line 26: | Line 17: | ||
===Example 1=== | ===Example 1=== | ||
This example presents a technique of Predictable Resource Location attack, which is based on a manual and oriented identification of resources by modifying URL parameters. | This example presents a technique of Predictable Resource Location attack, which is based on a manual and oriented identification of resources by modifying URL parameters. | ||
− | The user1 wants to check his on-line agenda | + | The user1 wants to check his on-line agenda through the following URL: |
<nowiki> www.site-example.com/users/calendar.php/user1/20070715 </nowiki> | <nowiki> www.site-example.com/users/calendar.php/user1/20070715 </nowiki> | ||
− | In the URL, it is possible to identify the username ( | + | In the URL, it is possible to identify the username (âuser1â) and the date (mm/dd/yyyy). If the user attempts to make a forced browsing attack, he could guess another userâs agenda by predicting user identification and date, as follow: |
<nowiki> www.site-example.com/users/calendar.php/user6/20070716 </nowiki> | <nowiki> www.site-example.com/users/calendar.php/user6/20070716 </nowiki> | ||
− | The attack can be considered successful upon accessing other user agenda. A bad implementation of the authorization mechanism | + | The attack can be considered successful upon accessing other user's agenda. A bad implementation of the authorization mechanism contributed to this attack's success. |
===Example 2 === | ===Example 2 === | ||
− | This example presents | + | This example presents an attack of static directory and file enumeration using an automated tool. |
− | A scanning tool, like [http://www.cirt.net/code/nikto.shtml | + | A scanning tool, like [http://www.cirt.net/code/nikto.shtml Nikto], has the ability to search for existing files and directories based on a database of well-know resources, such as: |
/system/ | /system/ | ||
Line 47: | Line 38: | ||
/test/ | /test/ | ||
− | When the tool receives | + | When the tool receives an âHTTP 200â message it means that such resource was found and should be manually inspected for valuable information. |
− | |||
==Related [[Threat Agents]]== | ==Related [[Threat Agents]]== | ||
− | |||
* [[Internal software developer]] | * [[Internal software developer]] | ||
==Related [[Attacks]]== | ==Related [[Attacks]]== | ||
− | + | * [[Path Traversal|Path Traversal (Path Manipulation)]] | |
− | *[[Path Traversal | ||
− | |||
− | |||
==Related [[Vulnerabilities]]== | ==Related [[Vulnerabilities]]== | ||
− | |||
* [[:Category:Access Control Vulnerability]] | * [[:Category:Access Control Vulnerability]] | ||
==Related [[Controls]]== | ==Related [[Controls]]== | ||
− | |||
* [[:Category: Access Control]] | * [[:Category: Access Control]] | ||
==References== | ==References== | ||
− | + | * Forceful Browsing â Imperva Application Data Security and Compliance http://www.imperva.com/application_defense_center/glossary/forceful_browsing.html | |
− | *Forceful Browsing | + | * Parameter fuzzing and forced browsing â WebAppSec - http://seclists.org/webappsec/2006/q3/0182.html |
− | + | * http://www.webappsec.org/projects/threat/classes/predictable_resource_location.shtml | |
− | *Parameter fuzzing and forced browsing | + | * http://cwe.mitre.org/data/definitions/425.html |
− | |||
− | *http://www.webappsec.org/projects/threat/classes/predictable_resource_location.shtml | ||
− | |||
− | *http://cwe.mitre.org/data/definitions/425.html | ||
− | |||
[[category:Resource Manipulation]] | [[category:Resource Manipulation]] | ||
[[Category:Attack]] | [[Category:Attack]] | ||
__NOTOC__ | __NOTOC__ |
Latest revision as of 20:04, 18 July 2018
Description
Forced browsing is an attack where the aim is to enumerate and access resources that are not referenced by the application, but are still accessible.
An attacker can use Brute Force techniques to search for unlinked contents in the domain directory, such as temporary directories and files, and old backup and configuration files. These resources may store sensitive information about web applications and operational systems, such as source code, credentials, internal network addressing, and so on, thus being considered a valuable resource for intruders.
This attack is performed manually when the application index directories and pages are based on number generation or predictable values, or using automated tools for common files and directory names.
This attack is also known as Predictable Resource Location, File Enumeration, Directory Enumeration, and Resource Enumeration.
Examples
Example 1
This example presents a technique of Predictable Resource Location attack, which is based on a manual and oriented identification of resources by modifying URL parameters. The user1 wants to check his on-line agenda through the following URL:
www.site-example.com/users/calendar.php/user1/20070715
In the URL, it is possible to identify the username (âuser1â) and the date (mm/dd/yyyy). If the user attempts to make a forced browsing attack, he could guess another userâs agenda by predicting user identification and date, as follow:
www.site-example.com/users/calendar.php/user6/20070716
The attack can be considered successful upon accessing other user's agenda. A bad implementation of the authorization mechanism contributed to this attack's success.
Example 2
This example presents an attack of static directory and file enumeration using an automated tool.
A scanning tool, like Nikto, has the ability to search for existing files and directories based on a database of well-know resources, such as:
/system/ /password/ /logs/ /admin/ /test/
When the tool receives an âHTTP 200â message it means that such resource was found and should be manually inspected for valuable information.
Related Threat Agents
Related Attacks
Related Vulnerabilities
Related Controls
References
- Forceful Browsing â Imperva Application Data Security and Compliance http://www.imperva.com/application_defense_center/glossary/forceful_browsing.html
- Parameter fuzzing and forced browsing â WebAppSec - http://seclists.org/webappsec/2006/q3/0182.html
- http://www.webappsec.org/projects/threat/classes/predictable_resource_location.shtml
- http://cwe.mitre.org/data/definitions/425.html