Contribute a skill

Application Web App Exploitation

description

Triage a web-app alert about server-side exploitation of an exposed surface by an external or unauthenticated client — exploit requests to vulnerable endpoints, RCE attempts, webshell file drops, and enumeration of an app's subaccounts or objects. Reads the request's source, shape, and outcome plus any follow-on activity to tell known scanners and failed probes apart from an external exploit that succeeded, and decides escalate or dismiss.

Triage Steps

This class is different from the rest of the domain: there is no internal actor identity to baseline, because the request itself is the evidence. The internet sends exploit-shaped traffic at exposed surfaces constantly — scanners, researchers, and broad opportunistic probing — so the fact that a hostile-looking request arrived is not the signal. The signal is where it came from, whether it matched the real exploit path, whether it worked, and what followed. Triage here is reading the request and its outcome and deciding whether it was a known scanner or a failed probe or an external exploit that landed. This class owns exploitation and object or subaccount enumeration driven by an external or unauthenticated client pulling data in through the app surface — the request is the evidence — distinct from an internal actor's authenticated bulk movement out, which is judged against that actor's baseline.

Begin with this detection's track record on this endpoint and source — a rule that fires on an internal known scanner sweeping the app nightly and is always closed benign starts the call near dismiss — then read the leads below. None is required on its own; they stack, and a single strong one (a success response after the exploit pattern, follow-on activity after the attempt) can carry the call.

Leads that point to a real threat — what to look for in the data:

  • An external exploit-shaped request to the vulnerable path. An outside source sending a request matching the known exploit path for the endpoint: a POST to a path with a serialization or template-injection payload, a traversal string reaching a config file, an injection in a parameter the endpoint is known to be vulnerable on. A malicious or suspicious reputation verdict on the source IP sharpens it, and the resource posture tells you how exposed and critical the app is.
  • A success response after the exploit pattern. A 200/201 or a meaningful body following the exploit request, where a probe would have drawn a 4xx. A success after the pattern means it likely landed.
  • A webshell-named file appearing in app activity. A file with a webshell-style name written through the app surface: a .jsp, .aspx, or .php upload into a web-served directory right after the exploit request.
  • Follow-on activity after the attempt. A new file or directory, a spawned child process, or an outbound callback in the same window as the exploit — the hardest escalator, because it says remote execution succeeded, not just that someone tried. It escalates unless every step traces to a documented in-window pentest from the testing source.

Leads that rule it out — benign context you can actually see in the data; if the data doesn't show it, you don't have it:

  • An internal known scanner. The source is an internal vulnerability scanner from its documented range, doing exactly the hostile-looking sweep it is built to do.
  • An authorized pentest in a window. The requests, and the files or follow-on they produce, fall inside a documented test window and trace to the documented testing source — hostile by design and expected. Follow-on that traces to a different source, or persists past the window, is not covered and stays escalate-reachable.
  • A failed probe with nothing after it. The exploit-shaped request drew a 4xx, and no file, process, or callback followed in the window — a try that did not land.
  • A success with no exploit shape. A 200 to the path that did not carry the exploit payload — a normal request to the endpoint, not the vulnerable path being hit.
  • Clean history. This rule has closed benign on this source or path before, with the same shape and no follow-on this time.

To confirm a lead instead of guessing, pull the thread: after the exploit-shaped request, did a new file land, a process spawn, or an outbound connection to an unusual place follow in the same window? Corroboration turns a suspicious request into a confirmed compromise.

Output

Decision

  • escalate: an external source sending a request that matched the vulnerable path, a success response after the exploit pattern, a webshell-named file appearing, or follow-on file, process, or callback activity — especially two together, with follow-on after the request the strongest of all.
  • dismiss: a failed probe with no follow-on, an internal known scanner, or an authorized pentest whose requests and follow-on trace to the documented testing source within its window. A dismiss is a positive call that the request is benign, made with that context in hand — a scanner's documented range you recognized, a failed response with an empty window after it you actually saw; a source you couldn't place or an outcome you couldn't confirm is not that context, and absence of a bad sign is not proof it's good. Dismiss is logged and reopenable; when the benign context is missing or you're unsure — or the request matched the exploit path and the response shows success from a source that is not a documented in-window pentest — escalate.

Evidence

The source (external versus internal known scanner or pentest) and its reputation, whether the request matched the vulnerable endpoint's exploit shape, the response outcome (failed / succeeded), any follow-on file, process, or callback, the app's exposure and criticality from the resource posture, and how this rule was handled here before.

Reasoning

Name the leads that decided it and how they stacked — an external request matching the vulnerable path with a success response followed by a new webshell file is escalate on its own; a failed probe from an internal scanner's documented range with nothing after it is dismiss.