CAPEC-144 Detect Unpublicized Web Services

An adversary searches a targeted web site for web services that have not been publicized. This attack can be especially dangerous since unpublished but available services may not have adequate security controls placed upon them given that an administrator may believe they are unreachable.

1. [Explore] [Find target web site] An adversary finds a target web site that they think may have unpublicized web services 2. [Explore] [Map the published web site] The adversary will map the published web site either by using an automated tool or by manually accessing well-known debugging or logging pages, or otherwise predictable pages within the site tree 3. [Experiment] [Try to find weaknesses or information] The adversary will try to find weaknesses in the unpublicized services that the targeted site did not intend to be public 4. [Exploit] [Follow-up attack] Use any information or weaknesses found to carry out a follow-up attack

• The targeted web site must include unpublished services within its web tree. The nature of these services determines the severity of this attack.