This attack utilizes the frequent client-server roundtrips in Ajax conversation to scan a system. While Ajax does not open up new vulnerabilities per se, it does optimize them from an attacker point of view. A common first step for an attacker is to footprint the target environment to understand what attacks will work. Since footprinting relies on enumeration, the conversational pattern of rapid, multiple requests and responses that are typical in Ajax applications enable an attacker to look for many vulnerabilities, well-known ports, network locations and so on. The knowledge gained through Ajax fingerprinting can be used to support other attacks, such as XSS.

How does a AJAX Footprinting attack work?

It typically unfolds over 1 phase. It begins with: [Send request to target webpage and analyze HTML] Using a browser or an automated tool, an adversary sends requests to a webpage and records the received HTML response. Adversaries then analyze the HTML to identify any known underlying JavaScript architectures. This can aid in mappiong publicly known vulnerabilities to the webpage and can also helpo the adversary guess application architecture and the inner workings of a system.

How do you prevent CAPEC-85?

Design: Use browser technologies that do not allow client side scripting.

What weaknesses does CAPEC-85 target?

CAPEC-85 exploits 9 CWE weaknesses, including CWE-20 (Improper Input Validation), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-86 (Improper Neutralization of Invalid Characters in Identifiers in Web Pages), CWE-96 (Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')).

How severe is CAPEC-85?

MITRE rates CAPEC-85 as Low severity with high likelihood of attack.

CAPEC-85: AJAX Footprinting

Overview

CAPEC-85 (AJAX Footprinting) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.

How the attack works

The phases an attacker typically follows.

Step 1
Explore
[Send request to target webpage and analyze HTML] Using a browser or an automated tool, an adversary sends requests to a webpage and records the received HTML response. Adversaries then analyze the HTML to identify any known underlying JavaScript architectures. This can aid in mappiong publicly known vulnerabilities to the webpage and can also helpo the adversary guess application architecture and the inner workings of a system.
- Record all "src" values inside script tags. These JavaScript files are compared to lists of files for known architectures. If there is a large match between the "src" values and architecture files, then it can be assumed that particular architecture is being used.

What the attacker needs

Prerequisites

The user must allow JavaScript to execute in their browser

Skills required

Medium skill: To land and launch a script on victim's machine with appropriate footprinting logic for enumerating services and vulnerabilities in JavaScript

Resources required

None: No specialized resources are required to execute this type of attack.

Consequences

What a successful CAPEC-85 attack can achieve.

Read Data

Affects: Confidentiality

How to mitigate it

Defenses that reduce the risk of CAPEC-85.

Design: Use browser technologies that do not allow client side scripting.
Implementation: Perform input validation for all remote content.

Examples

Footprinting can be executed over almost any protocol including HTTP, TCP, UDP, and ICMP, with the general goal of gaining further information about a host environment to launch further attacks. The attacker can probe the system for banners, vulnerabilities, filenames, available services, and in short anything the host process has access to. The results of the probe are either used to execute javascript (for example, if the attackers' footprint script identifies a vulnerability in a firewall permission, then the client side script executes a javascript to change client firewall settings, or an attacker may simply echo the results of the scan back out to a remote host for targeting future attacks) or to inform other data gathering activities in order to craft atta.

The CWE weaknesses that CAPEC-85 exploits.

Parent, child, and peer patterns in the CAPEC hierarchy.

Parent

CAPEC-580: System Footprinting

Can precede

CAPEC-63: Cross-Site Scripting (XSS)

Frequently asked questions

Common questions about CAPEC-85.

What is CAPEC-85?: This attack utilizes the frequent client-server roundtrips in Ajax conversation to scan a system. While Ajax does not open up new vulnerabilities per se, it does optimize them from an attacker point of view. A common first step for an attacker is to footprint the target environment to understand what attacks will work. Since footprinting relies on enumeration, the conversational pattern of rapid, multiple requests and responses that are typical in Ajax applications enable an attacker to look for many vulnerabilities, well-known ports, network locations and so on. The knowledge gained through Ajax fingerprinting can be used to support other attacks, such as XSS.
How does a AJAX Footprinting attack work?: It typically unfolds over 1 phase. It begins with: [Send request to target webpage and analyze HTML] Using a browser or an automated tool, an adversary sends requests to a webpage and records the received HTML response. Adversaries then analyze the HTML to identify any known underlying JavaScript architectures. This can aid in mappiong publicly known vulnerabilities to the webpage and can also helpo the adversary guess application architecture and the inner workings of a system.
How do you prevent CAPEC-85?: Design: Use browser technologies that do not allow client side scripting.
What weaknesses does CAPEC-85 target?: CAPEC-85 exploits 9 CWE weaknesses, including CWE-20 (Improper Input Validation), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-86 (Improper Neutralization of Invalid Characters in Identifiers in Web Pages), CWE-96 (Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')).
How severe is CAPEC-85?: MITRE rates CAPEC-85 as Low severity with high likelihood of attack.

References

Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.