Web Application Defender's Cookbook

Recipe 9-3: Preventing Forceful Browsing Attacks

This recipe shows you how to identify when attackers attempt to access resources without following the appropriate user interface work flows.

Ingredients

• ModSecurity
  • Version 2.7 or higher
• Directives
  • SecDisableBackendCompression
  • SecContentInjection
  • SecStreamOutBodyInspection
  • SecEncryptionEngine
  • SecEncryptionKey
  • SecEncryptionParam
  • SecEncryptionMethodRx

CAPEC-87: Forceful Browsing

An attacker employs forceful browsing to access portions of a website that are otherwise unreachable through direct URL entry.

Usually, a front controller or similar design pattern is employed to protect access to portions of a web application.

Forceful browsing enables an attacker to access information, perform privileged operations, and otherwise reach sections of the web application that have been improperly protected.

http://capec.mitre.org/data/definitions/87.html

Sample Attacks

Forceful browsing is an enumeration tactic attackers use to identify resources within a web application. These resources may not be presented by the current user interface but are still accessible if the proper request is sent. This technique can be used to identify hidden directories or backup files, but it may also be used to access other user data if access controls are improperly applied. Here is a sample scenario taken from an actual web assessment I conducted in which an application includes a “customer ID” value within the URL itself:

https://www.REDACTED.com/Cust/cust_5.php/ ...