Forced browsing

Thank you for visiting OWASP.org. We have migrated our community to a new web platform and regretably the content for this page needed to be programmatically ported from its previous wiki page. There’s still some work to be done.

Description

Forced browsing is an attack where the aim is to enumerate and access resources that are not referenced by the application, but are still accessible.

An attacker can use Brute Force techniques to search for unlinked contents in the domain directory, such as temporary directories and files, and old backup and configuration files. These resources may store sensitive information about web applications and operational systems, such as source code, credentials, internal network addressing, and so on, thus being considered a valuable resource for intruders.

This attack is performed manually when the application index directories and pages are based on number generation or predictable values, or using automated tools for common files and directory names.

This attack is also known as Predictable Resource Location, File Enumeration, Directory Enumeration, and Resource Enumeration.

Examples

Example 1

This example presents a technique of Predictable Resource Location attack, which is based on a manual and oriented identification of resources by modifying URL parameters. The user1 wants to check their on-line agenda through the following URL:

www.site-example.com/users/calendar.php/user1/20070715

In the URL, it is possible to identify the username (user1) and the date (mm/dd/yyyy). If the user attempts to make a forced browsing attack, they could guess another user’s agenda by predicting user identification and date, as follow:

www.site-example.com/users/calendar.php/user6/20070716

The attack can be considered successful upon accessing other user’s agenda. A bad implementation of the authorization mechanism contributed to this attack’s success.