Semantic URL attack
|This article needs additional or better citations for verification. (December 2009) (Learn how and when to remove this template message)|
In a semantic URL attack, a client manually adjusts the parameters of its request by maintaining the URL's syntax but altering its semantic meaning. This attack is primarily used against CGI driven websites.
A similar attack involving web browser cookies is commonly referred to as cookie poisoning.
Consider a web-based e-mail application where users can reset their password by answering the security question correctly, and allows the users to send the password to the e-mail address of their choosing. After they answer the security question correctly, the web page will arrive to the following web form where the users can enter their alternative e-mail address:
<form action="resetpassword.php" method="GET"> <input type="hidden" name="username" value="user001" /> <p>Please enter your alternative e-mail address:</p> <input type="text" name="altemail" /><br /> <input type="submit" value="Submit" /> </form>
The receiving page, resetpassword.php, has all the information it needs to send the password to the new e-mail. The hidden variable username contains the value user001, which is the username of the e-mail account.
Because this web form is using the GET data method, when the user submits email@example.com as the e-mail address where the user wants the password to be sent to, the user then arrives at the following URL:
This URL appears in the location bar of the browser, so the user can identify the username and the e-mail address through the URL parameters. The user may decide to steal other people's (user002) e-mail address by visiting the following URL as an experiment:
If the resetpassword.php accepts these values, it is vulnerable to a semantic URL attack. The new password of the user002 e-mail address will be generated and sent to firstname.lastname@example.org which causes user002's e-mail account to be stolen.
One method of avoiding semantic URL attacks is by using session variables. However, session variables can be vulnerable to other types of attacks such as session hijacking and cross-site scripting.
|This computer science article is a stub. You can help Wikipedia by expanding it.|