CAPEC-144: Detect Unpublicized Web Services
An adversary searches a targeted web site for web services that have not been publicized. This attack can be especially dangerous since unpublished but available services may not have adequate security controls placed upon them given that an administrator may believe they are unreachable.
Last updated
Overview
CAPEC-144 (Detect Unpublicized Web Services) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
How the attack works
The phases an attacker typically follows to carry out this attack.
- Step 1Explore
[Find target web site] An adversary finds a target web site that they think may have unpublicized web services
- Step 2Explore
[Map the published web site] The adversary will map the published web site either by using an automated tool or by manually accessing well-known debugging or logging pages, or otherwise predictable pages within the site tree
- Use Dirbuster to brute force directories and file names to find unpublicized web services
- Find a pattern in the naming of documents and extrapolate this pattern to discover additional documents that have been created but are no longer externally linked
- Step 3Experiment
[Try to find weaknesses or information] The adversary will try to find weaknesses in the unpublicized services that the targeted site did not intend to be public
- Use Nikto to look for web service vulnerabilities
- Step 4Exploit
[Follow-up attack] Use any information or weaknesses found to carry out a follow-up attack
What the attacker needs
Prerequisites
- The targeted web site must include unpublished services within its web tree. The nature of these services determines the severity of this attack.
Resources required
- Spidering tools to explore the target web site are extremely useful in this attack especially when attacking large sites. Some tools might also be able to automatically construct common service queries from known paths.
Frequently asked questions
Common questions about CAPEC-144.
- What is CAPEC-144?
- An adversary searches a targeted web site for web services that have not been publicized. This attack can be especially dangerous since unpublished but available services may not have adequate security controls placed upon them given that an administrator may believe they are unreachable.
- How does a Detect Unpublicized Web Services attack work?
- It typically unfolds over 4 phases. It begins with: [Find target web site] An adversary finds a target web site that they think may have unpublicized web services
- What weaknesses does CAPEC-144 target?
- CAPEC-144 exploits 1 CWE weakness, including CWE-425 (Direct Request ('Forced Browsing')).
- How severe is CAPEC-144?
- MITRE rates CAPEC-144 as Low severity.
References
Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.
Defend against CAPEC-144
Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.