312-50V9 · Question #608
Take a look at the following attack on a Web Server using obstructed URL: How would you protect from these attacks?
The correct answer is B. Create rules in IDS to alert on strange Unicode requests. Obfuscated URL attacks use hex or Unicode encoding to bypass input filters - creating IDS rules to detect anomalous encoding patterns is the recommended detection control.
Question
Take a look at the following attack on a Web Server using obstructed URL:
How would you protect from these attacks?
Exhibit
Options
- AConfigure the Web Server to deny requests involving "hex encoded" characters
- BCreate rules in IDS to alert on strange Unicode requests
- CUse SSL authentication on Web Servers
- DEnable Active Scripts Detection at the firewall and routers
How the community answered
(56 responses)- A2% (1)
- B84% (47)
- C9% (5)
- D5% (3)
Why each option
Obfuscated URL attacks use hex or Unicode encoding to bypass input filters - creating IDS rules to detect anomalous encoding patterns is the recommended detection control.
Blocking all hex-encoded characters at the web server would break normal web functionality, since percent-encoding (e.g., %20 for space) is a standard and required part of the URI specification per RFC 3986.
An Intrusion Detection System configured with rules targeting unusual Unicode or percent-encoded sequences in HTTP requests can alert security teams to encoding-based evasion attempts in real time. IDS operates at the traffic inspection layer, meaning it can analyze request content even when the web server itself decodes and processes the characters. This provides detection coverage without breaking legitimate web functionality that also relies on URI encoding.
SSL/TLS secures data in transit through encryption but performs no inspection of request content, so it provides no protection against URL obfuscation attacks.
Active Scripts Detection targets script injection vectors such as JavaScript or VBScript - it does not inspect or filter URL encoding patterns used in obfuscation attacks.
Concept tested: IDS detection of Unicode/hex URL obfuscation attacks
Source: https://owasp.org/www-community/attacks/Unicode_Encoding
Topics
Community Discussion
No community discussion yet for this question.