CAPEC-143 Detect Unpublicized Web Pages – Attack Pattern Analysis

CAPEC-143 Metadata

Likelihood of Attack

High

Typical Severity

Low

Overview

Summary

An adversary searches a targeted web site for web pages that have not been publicized. In doing this, the adversary may be able to gain access to information that the targeted site did not intend to make public.

Prerequisites

The targeted web site must include pages within its published tree that are not connected to its tree of links. The sensitivity of the content of these pages determines the severity of this attack.

Execution Flow

Step	Phase	Description	Techniques
1	Explore	[Find target web site] An adversary finds a target web site that they think may have unpublicized web pages
2	Explore	[Map the published web site] The adversary will map the published web site either by using an automated tool or by manually accessing well-known debugging or logging pages, or otherwise predictable pages within the site tree	Use Dirbuster to brute force directories and file names to find unpublicized pages Find a pattern in the naming of documents and extrapolate this pattern to discover additional documents that have been created but are no longer externally linked
3	Experiment	[Try to find weaknesses or information] The adversary will try to find weaknesses or information on the unpublicized pages that the targeted site did not intend to be public	Manually analyze files or pages for information that could be useful in a further attack Use a static analysis tool to find weaknesses in unpublished web pages
4	Exploit	[Follow-up attack] Use any information or weaknesses found to carry out a follow-up attack

Potential Solutions / Mitigations

No specific solutions listed.

Related Weaknesses (CWE)

CWE ID	Description
CWE-425	Direct Request ('Forced Browsing')

Related CAPECs

CAPEC ID	Description
CAPEC-150	An adversary exploits well-known locations for resources for the purposes of undermining the security of the target. In many, if not most systems, files and resources are organized in a default tree structure. This can be useful for adversaries because they often know where to look for resources or files that are necessary for attacks. Even when the precise location of a targeted resource may not be known, naming conventions may indicate a small area of the target machine's file tree where the resources are typically located. For example, configuration files are normally stored in the /etc director on Unix systems. Adversaries can take advantage of this to commit other types of attacks.

CAPEC ID

Description

CAPEC-150

An adversary exploits well-known locations for resources for the purposes of undermining the security of the target. In many, if not most systems, files and resources are organized in a default tree structure. This can be useful for adversaries because they often know where to look for resources or files that are necessary for attacks. Even when the precise location of a targeted resource may not be known, naming conventions may indicate a small area of the target machine's file tree where the resources are typically located. For example, configuration files are normally stored in the /etc director on Unix systems. Adversaries can take advantage of this to commit other types of attacks.

Stay Ahead of Attack Patterns

Understanding CAPEC patterns helps security professionals anticipate and thwart potential attacks. Leverage these insights to enhance threat modeling, strengthen your software development lifecycle, and train your security teams effectively.