CAPEC-32: XSS Through HTTP Query Strings

Description
An adversary embeds malicious script code in the parameters of an HTTP query string and convinces a victim to submit the HTTP request that contains the query string to a vulnerable web application. The web application then procedes to use the values parameters without properly validation them first and generates the HTML code that will be executed by the victim's browser.
Extended Description

During a UDP scan, a datagram is sent to a target port. If an 'ICMP Type 3 Port unreachable' error message is returned then the port is considered closed. Different types of ICMP messages can indicate a filtered port. UDP scanning is slower than TCP scanning. The protocol characteristics of UDP make port scanning inherently more difficult than with TCP, as well as dependent upon ICMP for accurate scanning. Due to ambiguities that can arise between open ports and filtered ports, UDP scanning results often require a high degree of interpretation and further testing to refine. In general, UDP scanning results are less reliable or accurate than TCP-based scanning.

Severity :

High

Possibility :

High

Type :

Detailed
Relationships with other CAPECs

This table shows the other attack patterns and high level categories that are related to this attack pattern.

CAPEC-588: DOM-Based XSS DOM-Based XSS CAPEC-591: Reflected XSS Reflected XSS CAPEC-592: Stored XSS Stored XSS
Prerequisites

This table shows the other attack patterns and high level categories that are related to this attack pattern.

  • Target client software must allow scripting such as JavaScript. Server software must allow display of remote generated HTML without sufficient input or output validation.
Skills required

This table shows the other attack patterns and high level categories that are related to this attack pattern.

  • Low To place malicious payload on server via HTTP
  • High Exploiting any information gathered by HTTP Query on script host
Taxonomy mappings

Mappings to ATT&CK, OWASP and other frameworks.

Resources required

Ability to send HTTP post to scripting host and collect output

Related CWE

A Related Weakness relationship associates a weakness with this attack pattern. Each association implies a weakness that must exist for a given attack to be successful.

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Visit http://capec.mitre.org/ for more details.