MITRE ATT&CK · T1190

Exploit Public-Facing Application

MITRE · cited in 106 of our lessons

What attackers do. Attackers exploit a weakness in an internet-facing system, such as a web application, VPN appliance, firewall, mail server or database, to get a foothold inside the network. This serves Initial Access and often leads quickly to web shells or credential theft.

How to defend. Keep an accurate inventory of everything exposed to the internet and patch it fast, prioritising vulnerabilities known to be exploited in the wild. Put a web application firewall in front of custom applications, reduce exposed management interfaces, and segment edge systems so a compromise does not reach the core network. Collect web server, application and appliance logs centrally, since many edge devices cannot run endpoint agents.

Signs to look for. Look for unusual requests or error spikes in web logs, new files in web directories, and server processes spawning shells or making outbound connections. A frequent gap is edge appliances with little logging and no endpoint visibility.

Open the technique on MITRE ATT&CK

The official text

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 106.