Dark Mode
Capec-53 Detail
Postfix, Null Terminate, and Backslash
Detailed Software Likelihood: High Typical Severity: High
Parents: 267
Threats: T62 T290 T291
Not present
| External ID | Source | Link | Description |
|---|---|---|---|
| CAPEC-53 | capec | https://capec.mitre.org/data/definitions/53.html | |
| CWE-158 | cwe | http://cwe.mitre.org/data/definitions/158.html | |
| CWE-172 | cwe | http://cwe.mitre.org/data/definitions/172.html | |
| CWE-173 | cwe | http://cwe.mitre.org/data/definitions/173.html | |
| CWE-74 | cwe | http://cwe.mitre.org/data/definitions/74.html | |
| CWE-20 | cwe | http://cwe.mitre.org/data/definitions/20.html | |
| CWE-697 | cwe | http://cwe.mitre.org/data/definitions/697.html | |
| CWE-707 | cwe | http://cwe.mitre.org/data/definitions/707.html | |
| REF-1 | reference_from_CAPEC | G. Hoglund, G. McGraw, Exploiting Software: How to Break Code, 2004--02, Addison-Wesley |
Explore
-
Survey the application for user-controllable inputs: Using a browser, an automated tool or by inspecting the application, an adversary records all entry points to the application.
| Techniques |
|---|
| Use a spidering tool to follow and record all links and analyze the web pages to find entry points. Make special note of any links that include parameters in the URL. |
| Use a proxy tool to record all user input entry points visited during a manual traversal of the web application. |
| Use a browser to manually explore the website and analyze how it is constructed. Many browsers' plugins are available to facilitate the analysis or automate the discovery. |
| Manually inspect the application to find entry points. |
Experiment
-
Probe entry points to locate vulnerabilities: The adversary uses the entry points gathered in the "Explore" phase as a target list and injects postfix null byte(s) followed by a backslash to observe how the application handles them as input. The adversary is looking for areas where user input is placed in the middle of a string, and the null byte causes the application to stop processing the string at the end of the user input.
| Techniques |
|---|
| Try different encodings for null such as \0 or %00 followed by an encoding for the backslash character. |
Exploit
-
Remove data after null byte(s): After determined entry points that are vulnerable, the adversary places a null byte(s) followed by a backslash such that they bypass an input filter and remove data after the null byte(s) in a way that is beneficial to them.
| Techniques |
|---|
| If the input is a directory as part of a longer file path, add a null byte(s) followed by a backslash at the end of the input to try to traverse to the given directory. |
- Null terminators are not properly handled by the filter.
Not present
| Medium |
|---|
| An adversary needs to understand alternate encodings, what the filter looks for and the data format acceptable to the target API |
| Integrity | Authorization | Access Control | Confidentiality |
|---|---|---|---|
| Modify Data | Gain Privileges | Gain Privileges | Read Data |
| Gain Privileges |
- A rather simple injection is possible in a URL: http://getAccessHostname/sekbin/helpwin.gas.bat?mode=&draw;=x&file;=x&module;=&locale;=[insert relative path here][%00][%5C]&chapter;= This attack has appeared with regularity in the wild. There are many variations of this kind of attack. Spending a short amount of time injecting against Web applications will usually result in a new exploit being discovered.