CAPEC-162: Manipulating Hidden Fields
An adversary exploits a weakness in the server's trust of client-side processing by modifying data on the client-side, such as price information, and then submitting this data to the server, which processes the modified data. For example, eShoplifting is a data manipulation attack against an on-line merchant during a purchasing transaction. The manipulation of price, discount or quantity fields in the transaction message allows the adversary to acquire items at a lower cost than the merchant intended. The adversary performs a normal purchasing transaction but edits hidden fields within the HTML form response that store price or other information to give themselves a better deal. The merchant then uses the modified pricing information in calculating the cost of the selected items.
Last updated
Overview
CAPEC-162 (Manipulating Hidden Fields) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
How the attack works
The phases an attacker typically follows to carry out this attack.
- Step 1Explore
[Probe target web application] The adversary first probes the target web application to find all possible pages that can be visited on the website.
- Use a spidering tool to follow and record all links
- Use a proxy tool to record all links visited during a manual traversal of the web application.
- Step 2Explore
[Find hidden fields] Once the web application has been traversed, the adversary looks for all hidden HTML fields present in the client-side.
- Use the inspect tool on all modern browsers and filter for the keyword "hidden"
- Specifically look for hidden fields inside form elements.
- Step 3Experiment
[Send modified hidden fields to server-side] Once the adversary has found hidden fields in the client-side, they will modify the values of these hidden fields one by one and then interact with the web application so that this data is sent to the server-side. The adversary observes the response from the server to determine if the values of each hidden field are being validated.
- Step 4Exploit
[Manipulate hidden fields] Once the adversary has determined which hidden fields are not being validated by the server, they will manipulate them to change the normal behavior of the web application in a way that benefits the adversary.
- Manipulate a hidden field inside a form element and then submit the form so that the manipulated data is sent to the server.
What the attacker needs
Prerequisites
- The targeted site must contain hidden fields to be modified.
- The targeted site must not validate the hidden fields with backend processing.
Resources required
- The adversary must have the ability to modify hidden fields by editing the HTTP response to the server.
Frequently asked questions
Common questions about CAPEC-162.
- What is CAPEC-162?
- An adversary exploits a weakness in the server's trust of client-side processing by modifying data on the client-side, such as price information, and then submitting this data to the server, which processes the modified data. For example, eShoplifting is a data manipulation attack against an on-line merchant during a purchasing transaction. The manipulation of price, discount or quantity fields in the transaction message allows the adversary to acquire items at a lower cost than the merchant intended. The adversary performs a normal purchasing transaction but edits hidden fields within the HTML form response that store price or other information to give themselves a better deal. The merchant then uses the modified pricing information in calculating the cost of the selected items.
- How does a Manipulating Hidden Fields attack work?
- It typically unfolds over 4 phases. It begins with: [Probe target web application] The adversary first probes the target web application to find all possible pages that can be visited on the website.
- What weaknesses does CAPEC-162 target?
- CAPEC-162 exploits 1 CWE weakness, including CWE-602 (Client-Side Enforcement of Server-Side Security).
- How severe is CAPEC-162?
- MITRE rates CAPEC-162 as High severity.
References
Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.
Defend against CAPEC-162
Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.