CAPEC-207: Removing Important Client Functionality
An adversary removes or disables functionality on the client that the server assumes to be present and trustworthy.
Last updated
Overview
Adversaries can, in some cases, get around logic put in place to 'guard' sensitive functionality or data. Client applications may include functionality that a server relies on for correct and secure operation. This functionality can include, but is not limited to, filters to prevent the sending of dangerous content to the server, logical functionality such as price calculations, and authentication logic to ensure that only authorized users are utilizing the client. If an adversary can disable this functionality on the client, they can perform actions that the server believes are prohibited. This can result in client behavior that violates assumptions by the server leading to a variety of possible attacks. In the above examples, this could include the sending of dangerous content (such as scripts) to the server, incorrect price calculations, or unauthorized access to server resources.
How the attack works
The phases an attacker typically follows to carry out this attack.
- Step 1Explore
[Probing] The adversary probes, through brute-forcing, reverse-engineering or other similar means, the functionality on the client that server assumes to be present and trustworthy.
- The adversary probes by exploring an application's functionality and its underlying mapping to server-side components.
- The adversary reverse engineers client-side code to identify the functionality that the server relies on for the proper or secure operation.
- Step 2Experiment
[Determine which functionality to disable or remove] The adversary tries to determine which functionality to disable or remove through reverse-engineering from the list of functionality identified in the Explore phase.