Detailed attack pattern

Draft

CAPEC-86: XSS Through HTTP Headers

An adversary exploits web applications that generate web content, such as links in a HTML page, based on unvalidated or improperly validated data submitted by other actors. XSS in HTTP Headers attacks target the HTTP headers which are hidden from most users and may not be validated by web applications.

Very High

Typical severity

Per MITRE

High

Likelihood of attack

Per MITRE

Related weaknesses

CWEs this targets

Detailed

Abstraction

MITRE classification

Overview

CAPEC-86 (XSS Through HTTP Headers) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.

How the attack works

The phases an attacker typically follows to carry out this attack.

Step 1
Explore
[Survey the application for public links] Using a browser or an automated tool, an adversary follows all public links on a web site. They record all the entry points (input) that becomes part of generated HTTP header (not only GET/POST/COOKIE, but also Content-Type, etc.)
- Use a spidering tool to follow and record all links and analyze the web pages to find entry points. Make special note of any links that include parameters used in the HTTP headers.
- Look for HTML meta tags that could be injectable
- Use a proxy tool to record all links visited during a manual traversal of the web application.
- Use a browser to manually explore the website and analyze how it is constructed. Many browsers' plugins are available to facilitate the analysis or automate the discovery.
Step 2
Experiment
[Probe identified potential entry points for XSS vulnerability]
- Manually inject various script payloads into each identified entry point using a list of common script injection probes and observe system behavior to determine if script was executed.
- Use an automated injection attack tool to inject various script payloads into each identified entry point using a list of common script injection probes and observe system behavior to determine if script was executed.
- Use a proxy tool to record results of manual input of XSS probes in known URLs.
Step 3
Experiment
[Craft malicious XSS URL] Once the adversary has determined which parameters are vulnerable to XSS, they will craft a malicious URL containing the XSS exploit. The adversary can have many goals, from stealing session IDs, cookies, credentials, and page content from the victim.
- Change a URL parameter which is used in an HTTP header to include a malicious script tag. Because it is in the header it may bypass validation.
- Send information gathered from the malicious script to a remote endpoint.
Step 4
Exploit
[Get victim to click URL] In order for the attack to be successful, the victim needs to access the malicious URL.
- Send a phishing email to the victim containing the malicious URL. This can be hidden in a hyperlink as to not show the full URL, which might draw suspicion.
- Put the malicious URL on a public forum, where many victims might accidentally click the link.

CAPEC-86: XSS Through HTTP Headers

Overview

How the attack works

What the attacker needs

Prerequisites

Skills required

Resources required

Consequences

How to mitigate it

Examples

Frequently asked questions

What is CAPEC-86?

How does a XSS Through HTTP Headers attack work?

How do you prevent CAPEC-86?

What weaknesses does CAPEC-86 target?

How severe is CAPEC-86?

References

Defend against CAPEC-86

Overview

How the attack works

What the attacker needs

Prerequisites

Skills required

Resources required

Consequences

How to mitigate it

Examples

Related weaknesses

Related attack patterns

Parent

Frequently asked questions

What is CAPEC-86?

How does a XSS Through HTTP Headers attack work?

How do you prevent CAPEC-86?

What weaknesses does CAPEC-86 target?

How severe is CAPEC-86?

References

Defend against CAPEC-86