Register to stream ATT&CKcon 2.0 October 29-30

Exploit Public-Facing Application

The use of software, data, or commands to take advantage of a weakness in an Internet-facing computer system or program in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL) [1], standard services (like SMB [2] or SSH), and any other applications with Internet accessible open sockets, such as web servers and related services. [3] Depending on the flaw being exploited this may include Exploitation for Defense Evasion.

For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities. [4] [5]

ID: T1190
Tactic: Initial Access
Platform: Linux, Windows, macOS
Data Sources: Packet capture, Web logs, Web application firewall logs, Application logs
Version: 1.1

Procedure Examples

Name Description
Axiom Axiom has been observed using SQL injection to gain access to systems. [9] [10]
Havij Havij is used to automate SQL injection. [6]
Night Dragon Night Dragon has performed SQL injection attacks of extranet web servers to gain access. [8]
Soft Cell Soft Cell exploited a publicly-facing server to gain access to the network. [11]
sqlmap sqlmap can be used to automate exploitation of SQL injection vulnerabilities. [7]

Mitigations

Mitigation Description
Application Isolation and Sandboxing Application isolation will limit what other processes and system features the exploited target can access.
Exploit Protection Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application.
Network Segmentation Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.
Privileged Account Management Use least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system.
Update Software Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.
Vulnerability Scanning Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.

Detection

Monitor application logs for abnormal behavior that may indicate attempted or successful exploitation. Use deep packet inspection to look for artifacts of common exploit traffic, such as SQL injection. Web Application Firewalls may detect improper inputs attempting exploitation.

References