4

What kind of attack surface is there for a site that only hosts static content: HTML, images, CSS? How can sites like this be successfully penetrated?

  • 1
    Any service that is accepting and processing requests is the attack surface. So in case of a web server, it’s the web server that may contain vulnerabilities that can be exploited. – Gumbo Jun 21 '14 at 9:44
8

Even when there is no vulnerable web application, there is still plenty of other code which could be vulnerable.

  • The static content has to get onto the server somehow, for example via FTP or a password-protected web interface. The password for these might be too weak or these services might have other vulnerabilities.
  • The web server itself might have a vulnerability which still applies in this limited use scenario.
  • The operating system of the webserver might have vulnerabilities
  • Or the operating system might offer some form of remote login (like SSH on UNIX, RDP on Windows or VNC on either) which is insufficiently secured.
  • And then there is also physical access to the hardware of the server.
4

Static pages are still susceptible to Fragment attacks:

The technique to avoid sending the payload to the server hinges on the fact that URI fragments (the part in the URI after the “#”) is not sent to the server by the browser. Thus, any client side code that references, say, document.location, may be vulnerable to an attack which uses fragments, and in such case the payload is never sent to the server. For example, the above DOM based XSS can be modified into:

http://www.some.site/page.html#default=<script>alert(document.cookie)</script>

which mounts the same attack without it being seen by the server (which will simply see a request for page.html without any URL parameters).

In December 2006, Stefano Di Paola and Giorgio Fedon described a universal XSS attack against the Acrobat PDF plugin ([4]). This attack applied the fragment variant of DOM based XSS to PDF documents. The researchers discovered that a PDF document served to the browser, when rendered by the Acrobat plugin, may end up executing part of the fragment as Javascript. Since the Javascript is executed in the context (DOM) of the current site, all an attacker needed to exploit this flaw was to simply find a PDF link somewhere on the site for the XSS condition to be met.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.