This attack leverages the possibility to encode potentially harmful input
and submit it to applications not expecting or effective at validating this
encoding standard making input filtering difficult.
Attack Execution Flow
Explore
Survey the application for
user-controllable inputs::
Using a browser, an automated tool or by
inspecting the application, an attacker records all
entry points to the application.
Attack Step Techniques
ID
Attack Step Technique Description
Environments
1
Use a spidering tool to follow and record
all links and analyze the web pages to find entry
points. Make special note of any links that
include parameters in the URL.
env-Web
2
Use a proxy tool to record all user input
entry points visited during a manual traversal of
the web application.
env-Web
3
Use a browser to manually explore the
website and analyze how it is constructed. Many
browsers' plugins are available to facilitate the
analysis or automate the discovery.
env-Web
4
Manually inspect the application to find
entry points.
env-All
Indicators
ID
Type
Indicator Description
Environments
1
Positive
Inputs are used by the application or the
browser (DOM)
env-All env-Web
2
Inconclusive
Using URL rewriting, parameters may be part
of the URL path.
env-Web
3
Inconclusive
No parameters appear to be used by the
application. Even though none appear, the
application may still use them if they are
provided.
env-Web
4
Inconclusive
No inputs seem to be used by the
application. They might still be provided to
another component (web service, database, system
call, etc.).
env-All env-Web
5
Negative
Applications that have only static pages or
that simply present information without accepting
input are unlikely to be susceptible.
env-Web
Outcomes
ID
Type
Outcome Description
1
Success
A list of entry points (URL,
parameters, configuration files, etc.) is created
by the attacker.
2
Success
A list of resources accessed by
the application is created by the
attacker.
Security Controls
ID
Type
Security Control Description
1
Detective
Monitor velocity of
page fetching in web logs. Humans who view a page
and select a link from it will click far slower
and far less regularly than tools. Tools make
requests very quickly and the requests are
typically spaced apart regularly (e.g. 0.8 seconds
between them).
2
Detective
Create links on some
pages that are visually hidden from web browsers.
Using IFRAMES, images, or other HTML techniques,
the links can be hidden from web browsing humans,
but visible to spiders and programs. A request for
the page, then, becomes a good predictor of an
automated tool probing the
application.
3
Preventative
Use CAPTCHA to prevent
the use of the application by an automated
tool.
4
Preventative
Actively monitor the
application and either deny or redirect requests
from origins that appear to be
automated.
Experiment
Probe entry points to locate
vulnerabilities::
The attacker uses the entry points gathered in the
"Explore" phase as a target list and injects various
payloads using a variety of different types of
encodings to determine if an entry point actually
represents a vulnerability with insufficient
validation logic and to characterize the extent to
which the vulnerability can be exploited.
Attack Step Techniques
ID
Attack Step Technique Description
Environments
1
Try to use different encodings of content in
order to bypass validation routines.
env-All env-Web
Indicators
ID
Type
Indicator Description
Environments
1
Positive
The application accepts user-controllable
input.
env-All env-Web
Outcomes
ID
Type
Outcome Description
1
Success
The attacker's encoded payload
is processed and acted on by the application
without filtering or
transcoding.
2
Failure
The application decodes the
charset and filters the
inputs.
Security Controls
ID
Type
Security Control Description
1
Detective
Monitor inputs to web
servers. Alert on unusual charset and/or
characters.
2
Preventative
Implement input
validation routines that canonicalize and filter
user submitted
content.
3
Preventative
Specify the charset of
the HTTP
transaction/content.
4
Preventative
Actively monitor the
application and either deny or redirect requests
from origins that appear to be attack
attempts.
Attack Prerequisites
The application's decoder accepts and interprets encoded characters. Data
canonicalization, input filtering and validating is not done properly
leaving the door open to harmful characters for the target host.
Typical Likelihood of Exploit
Likelihood: High
Methods of Attack
Injection
Protocol Manipulation
API Abuse
Examples-Instances
Description
Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not
properly handle unspecified "encoding strings," which allows remote
attackers to bypass the Same Origin Policy and obtain sensitive
information via a crafted web site, aka "Post Encoding Information
Disclosure Vulnerability." Related Vulnerabilities CVE-2010-0488
Attacker Skills or Knowledge Required
Skill or Knowledge Level: Low
An attacker can inject different representation of a filtered
character in a different encoding.
Skill or Knowledge Level: Medium
An attacker may craft subtle encoding of input data by using the
knowledge that he/she has gathered about the target host.
Probing Techniques
Description
Attacker may try to inject dangerous characters using different
encoding using (example of invalid UTF-8 characters, overlong UTF-8,
Chinese characters in Big-5, etc.). The attacker hopes that the targeted
system does poor input filtering for all the different possible
representations of the malicious characters. Malicious inputs can be
sent through an HTML form, directly encoded in the URL or as part of a
database query. The attacker can use scripts or automated tools to probe
for poor input filtering.
Solutions and Mitigations
Assume all input might use an improper representation. Use canonicalized
data inside the application; all data must be converted into the
representation used inside the application (UTF-8, UTF-16, etc.)
Assume all input is malicious. Create a white list that defines all valid
input to the software system based on the requirements specifications. Input
that does not match against the white list should not be permitted to enter
into the system. Test your decoding process against malicious input.
Description
