What kind of attack surface is there for a site that only hosts static content: HTML, images, CSS? How can sites like this be successfully penetrated?
Even when there is no vulnerable web application, there is still plenty of other code which could be vulnerable.
- The static content has to get onto the server somehow, for example via FTP or a password-protected web interface. The password for these might be too weak or these services might have other vulnerabilities.
- The web server itself might have a vulnerability which still applies in this limited use scenario.
- The operating system of the webserver might have vulnerabilities
- Or the operating system might offer some form of remote login (like SSH on UNIX, RDP on Windows or VNC on either) which is insufficiently secured.
- And then there is also physical access to the hardware of the server.
Static pages are still susceptible to Fragment attacks:
The technique to avoid sending the payload to the server hinges on the fact that URI fragments (the part in the URI after the “#”) is not sent to the server by the browser. Thus, any client side code that references, say,
document.location, may be vulnerable to an attack which uses fragments, and in such case the payload is never sent to the server. For example, the above DOM based XSS can be modified into:
which mounts the same attack without it being seen by the server (which will simply see a request for page.html without any URL parameters).