CAPEC 6

Summary

Attack Execution Flow

1. Discovery of potential injection vectors:

   Using an automated tool or manual discovery, the attacker identifies services or methods with arguments that could potentially be used as injection vectors (OS, API, SQL procedures, etc.).

   Attack Step Techniques

   ID	Attack Step Technique Description	Environments
   1	Manually cover the application and record the possible places where arguments could be passed into external systems.	env-All
   2	Use a spider, for web applications, to create a list of URLs and associated inputs.	env-All

   Indicators

   ID	type	Indicator Description	Environments
   1	Positive	Arguments are used by the application in exposed services or methods	env-All
   2	Inconclusive	No parameters appear to be used.	env-All
   3	Negative	Application does not use any inputs.	env-All

   Outcomes

   ID	type	Outcome Description
   1	Success	A list of parameters, arguments to modify is identified.
   2	Success	A list of URLs, with their corresponding parameters (POST, GET, COOKIE, etc.) is created by the attacker.

   Security Controls

   ID	type	Security Control Description
   1	Detective	Monitor velocity of page fetching in web logs. Humans who view a page and select a link from it will click far slower and far less regularly than tools. Tools make requests very quickly and the requests are typically spaced apart regularly (e.g. 0.8 seconds between them).
   2	Detective	Create links on some pages that are visually hidden from web browsers. Using IFRAMES, images, or other HTML techniques, the links can be hidden from web browsing humans, but visible to spiders and programs. A request for the page, then, becomes a good predictor of an automated tool probing the application.
   3	Preventative	Use CAPTCHA to prevent the use of the application by an automated tool.
   4	Preventative	Actively monitor the application and either deny or redirect requests from origins that appear to be automated.

1. 1. Attempt variations on argument content:

   Possibly using an automated tool, the attacker will perform injection variations of the arguments.

   Attack Step Techniques

   ID	Attack Step Technique Description	Environments
   1	Use a very large list of probe strings in order to detect if there is a positive result, and, what type of system has been targeted (if obscure).	env-All
   2	Use a proxy tool to record results, error messages and/or log if accessible.	env-All

   Indicators

   ID	type	Indicator Description	Environments
   1	Positive	The application behaves like the injection has been a success.	env-All
   2	Inconclusive	No result appears.	env-All

   Outcomes

   ID	type	Outcome Description
   1	Failure	It is possible to monitor the application and to see that the argument has been validated.

   Security Controls

   ID	type	Security Control Description
   1	Preventative	Actively monitor malicious inputs.
   2	Detective	Monitor the services and/or methods uses of the arguments.

1. Abuse of the application:

   The attacker injects specific syntax into a particular argument in order to generate a specific malicious effect in the targeted application.

   Attack Step Techniques

   ID	Attack Step Technique Description	Environments
   1	Manually inject specific payload into targeted argument.	env-All

   Outcomes

   ID	type	Outcome Description
   1	Success	The attacker observes desired effect.

   Security Controls

   ID	type	Security Control Description
   2	Preventative	Actively monitor malicious inputs.
   3	Detective	Monitor the services and/or methods uses of the arguments.

Likelihood: High

Description

Skill or Knowledge Level: Medium

The attacker has to identify injection vector, identify the operating system-specific commands, and optionally collect the output.

Design: Do not program input values directly on command shell, instead treat user input as guilty until proven innocent. Build a function that takes user input and converts it to applications specific types and values, stripping or filtering out all unauthorized commands and characters in the process.

Design: Limit program privileges, so if metacharcters or other methods circumvent program input validation routines and shell access is attained then it is not running under a privileged account. chroot jails create a sandbox for the application to execute in, making it more difficult for an attacker to elevate privilege even in the case that a compromise has occurred.

Implementation: Implement an audit log that is written to a separate host, in the event of a compromise the audit log may be able to provide evidence and details of the compromise.