CAPEC-54: Query System for Information
CAPEC版本: 3.9
更新日期: 2023-01-24
攻击模式描述
An adversary, aware of an application's location (and possibly authorized to use the application), probes an application's structure and evaluates its robustness by submitting requests and examining responses. Often, this is accomplished by sending variants of expected queries in the hope that these modified queries might return information beyond what the expected set of queries would provide.
执行流程
步骤 1 Explore
[Determine parameters] Determine all user-controllable parameters of the application either by probing or by finding documentation
步骤 2 Experiment
[Cause error condition] Inject each parameter with content that causes an error condition to manifest
步骤 3 Experiment
[Modify parameters] Modify the content of each parameter according to observed error conditions
步骤 4 Exploit
[Follow up attack] Once the above steps have been repeated with enough parameters, the application will be sufficiently mapped out. The adversary can then launch a desired attack (for example, Blind SQL Injection)
前提条件
- This class of attacks does not strictly require authorized access to the application. As Attackers use this attack process to classify, map, and identify vulnerable aspects of an application, it simply requires hypotheses to be verified, interaction with the application, and time to conduct trial-and-error activities.
所需技能
所需资源
后果影响
影响范围: Confidentiality
技术影响: Read Data
缓解措施
Application designers can construct a 'code book' for error messages. When using a code book, application error messages aren't generated in string or stack trace form, but are cataloged and replaced with a unique (often integer-based) value 'coding' for the error. Such a technique will require helpdesk and hosting personnel to use a 'code book' or similar mapping to decode application errors/logs in order to respond to them normally.
Application designers can wrap application functionality (preferably through the underlying framework) in an output encoding scheme that obscures or cleanses error messages to prevent such attacks. Such a technique is often used in conjunction with the above 'code book' suggestion.
示例实例
Blind SQL injection is an example of this technique, applied to successful exploit. See also: CVE-2006-4705