Poisoned Pipeline / Techniques / T0101
Discover technology stacks
This technique involves analyzing the technology stacks used in an application, such as programming languages, frameworks, libraries, and other related technologies.
By identifying the specific technology stack used in an application, an attacker can gain insights into the potential vulnerabilities associated with that technology, as well as potential attack vectors and weak spots in the application.
For example, an attacker might use this technique to identify specific versions of a library or software component used in an application, which could then be cross-referenced with known vulnerabilities to determine if the application is at risk.
Alternatively, an attacker might analyze the technology stack to determine the overall architecture of the application and identify potential attack vectors or weak spots.
Where this idea came from
Polyfill.io attackers picked a JS library embedded across hundreds of thousands of sites; dependency-confusion operators profile target stacks. Also OWASP recon guidance.
- https://sansec.io/research/polyfill-supply-chain-attack
- https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/01-Information_Gathering/README
Mitigations
- M1000 Limit Publicly Available Information
- M1503 Implement SCA analysis
- M1720 Implement regular patches and updates
- M1730 Implement code reviews
- M1732 Implement code scanning for security risks
Detections
- D1500 Configure monitoring of used artifacts and open-source libraries