CAPEC-87 Forceful Browsing

An attacker employs forceful browsing (direct URL entry) to access portions of a website that are otherwise unreachable. Usually, a front controller or similar design pattern is employed to protect access to portions of a web application. Forceful browsing enables an attacker to access information, perform privileged operations and otherwise reach sections of the web application that have been improperly protected.

1. [Explore] [Spider] Using an automated tool, an attacker follows all public links on a web site. They record all the links they find. 2. [Experiment] [Attempt well-known or guessable resource locations] Using an automated tool, an attacker requests a variety of well-known URLs that correspond to administrative, debugging, or other useful internal actions. They record all the positive responses from the server. 3. [Exploit] [Use unauthorized resources] By visiting the unprotected resource, the attacker makes use of unauthorized functionality. 4. [Exploit] [View unauthorized data] The attacker discovers and views unprotected sensitive data.

• The forcibly browseable pages or accessible resources must be discoverable and improperly protected.

• [Low] Forcibly browseable pages can be discovered by using a number of automated tools. Doing the same manually is tedious but by no means difficult.

• Confidentiality: Read Data • Confidentiality, Access Control, Authorization: Bypass Protection Mechanism

• Authenticate request to every resource. In addition, every page or resource must ensure that the request it is handling has been made in an authorized context. • Forceful browsing can also be made difficult to a large extent by not hard-coding names of application pages or resources. This way, the attacker cannot figure out, from the application alone, the resources available from the present context.