CORSICA：跨域Web服务标识
CORSICA: Cross-Origin Web Service Identification
摘要：
私有网络中的漏洞很难被网络外部的攻击者检测到。虽然存在用于端口扫描内部主机的已知方法，其通过将不知情的内部用户引诱到托管恶意JavaScript代码的外部网页来工作，但是不知道用于详细和精确的服务标识的这种方法。原因是同源策略（SOP）默认情况下阻止访问其他来源的HTTP响应。我们对SOP中的漏洞进行了结构化分析，这些漏洞可用于识别跨网络边界的Web应用程序。为此，我们分析了符合标准的Web浏览器的HTML5，CSS和JavaScript功能，这些功能可能会泄露有关跨源内容的敏感信息。结果揭示了几种新颖的技术，包括泄漏所有常见浏览器中可用的跨域请求的JavaScript函数名或样式。我们实现和测试这些技术中的一个工具，称为CORSICA。它可以成功识别在不同物联网设备上运行的42个Web服务中的31个（74%），以及四个最广泛使用的内容管理系统WordPress，Drupal，Joomla和TYPO3的版本号。CORSICA还可以确定补丁级别，平均分为三个版本（WordPress），六个版本（Drupal），两个版本（Joomla）和四个版本（TYPO3），平均只有十个请求。此外，CORSICA能够识别出48个WordPress插件，其中包含65个漏洞。最后，我们分析了缓解策略，并表明，建议，但尚未实施的策略跨源资源策略（CORP）和SEC元数据将阻止我们的识别技术。
英文摘要：
Vulnerabilities in private networks are difficult to detect for attackers outside of the network. While there are known methods for port scanning internal hosts that work by luring unwitting internal users to an external web page that hosts malicious JavaScript code, no such method for detailed and precise service identification is known. The reason is that the Same Origin Policy (SOP) prevents access to HTTP responses of other origins by default. We perform a structured analysis of loopholes in the SOP that can be used to identify web applications across network boundaries. For this, we analyze HTML5, CSS, and JavaScript features of standard-compliant web browsers that may leak sensitive information about cross-origin content. The results reveal several novel techniques, including leaking JavaScript function names or styles of cross-origin requests that are available in all common browsers. We implement and test these techniques in a tool called CORSICA. It can successfully identify 31 of 42 (74%) of web services running on different IoT devices as well as the version numbers of the four most widely used content management systems WordPress, Drupal, Joomla, and TYPO3. CORSICA can also determine the patch level on average down to three versions (WordPress), six versions (Drupal), two versions (Joomla), and four versions (TYPO3) with only ten requests on average. Furthermore, CORSICA is able to identify 48 WordPress plugins containing 65 vulnerabilities. Finally, we analyze mitigation strategies and show that the proposed but not yet implemented strategies Cross-Origin Resource Policy (CORP)} and Sec-Metadata would prevent our identification techniques.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
