What is exploitation of a public-facing application?¶
Exploitation of a public-facing application occurs when an offender abuses a vulnerability or weakness in an internet-accessible application to gain unauthorised access or effect.
Avoid the dangerous assumption¶
The dangerous assumption is that every compromise of a public service began with a software exploit.
It may instead involve stolen credentials, insecure configuration, exposed administration or abuse of legitimate features.
Investigators should identify:
- the application
- version and configuration
- exposure period
- authentication controls
- relevant vulnerability
- suspicious requests
- server responses
- process or file activity
- new accounts or sessions
- subsequent movement.
Useful evidence may exist in web-server logs, application logs, reverse proxies, cloud audit records, endpoint telemetry, database logs and deployment systems.
A scanner request, error response or exploit pattern may show attempted exploitation.
Successful exploitation normally requires evidence of a resulting effect, such as command execution, unauthorised data access, file upload or account creation.
Do not assume a shared IP address identifies the offender. Public-facing applications are routinely scanned and attacked through distributed infrastructure.
Also preserve configuration and code changes made during response.
Patching the application may be necessary, but it can alter evidence about the vulnerable state.
If the application runs across several servers or containers, identify which instance handled the request. A shared service log may show the attempt while endpoint evidence identifies where any resulting process actually ran.
Preserve load-balancer and routing records where available.
Those records may identify the actual affected instance.
Operational takeaway¶
Prove the vulnerable condition, exploit attempt and resulting unauthorised effect before describing a public-facing application as successfully exploited.