CAPEC-87: Forceful Browsing
Description
An attacker employs forceful browsing (direct URL entry) to access portions of a website that are otherwise unreachable. Usually, a front controller or similar design pattern is employed to protect access to portions of a web application. Forceful browsing enables an attacker to access information, perform privileged operations and otherwise reach sections of the web application that have been improperly protected.
- Likelihood of attack
- High
- Typical severity
- High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Subvert Access Control
Prerequisites
- The forcibly browseable pages or accessible resources must be discoverable and improperly protected.
Skills required
- LowForcibly browseable pages can be discovered by using a number of automated tools. Doing the same manually is tedious but by no means difficult.
Consequences
- Confidentiality
Read Data
- ConfidentialityAccess ControlAuthorization
Bypass Protection Mechanism
Mitigations
- Authenticate request to every resource. In addition, every page or resource must ensure that the request it is handling has been made in an authorized context.
- Forceful browsing can also be made difficult to a large extent by not hard-coding names of application pages or resources. This way, the attacker cannot figure out, from the application alone, the resources available from the present context.