|
Naziv
|
Forceful Browsing
|
|
Sažetak
|
An attacker employs forceful browsing to access portions of a website that are otherwise unreachable through direct URL entry. Usually, a front controller or similar design pattern is employed to protect access to portions of a web application. Forceful browsing enables an attacker to access information, perform privileged operations and otherwise reach sections of the web application that have been improperly protected.
|
|
Preduvjeti
|
The forcibly browseable pages or accessible resources must be discoverable and improperly protected.
|
|
Rješenja
|
['Authenticate request to every resource. In addition, every page or resource must ensure that the request it is handling has been made in an authorized context.', 'Forceful browsing can also be made difficult to a large extent by not hard-coding names of application pages or resources. This way, the attacker cannot figure out, from the application alone, the resources available from the present context.']
|
