Download Mykonos Security User Guide

Processor Reference
Configuration
Table 6.1.
Parameter
Type
Default Value
Description
Basic
Processor Enabled
Boolean
True
Whether or not to enable
this process for https
traffic.
Malicious Boolean
True
The
user
manually
entered the URL into the
browser and accessed the
service that way. They
did not call the function.
Incident:
Service Boolean
Directory Indexing
True
The user asked for a file
index on the directory
that contains the fake
service.
Incident:
Service Boolean
Directory Spider
True
The user is issuing
requests for resources
inside the directory that
contains the fake service.
Since the directory
does not exist, all of
these types of requests
are unintended and
malicious.
Fake Service
Random
The fake service the user
requested.
Advanced
Incident:
Service Call
String
Incidents
Incident Name: Malicious Service Call
Complexity: Medium
Default Response: 1x = 5 day block
Cause: MWS adds a fake cookie to the websites it protects. The cookie is intended to look as though
it is part of the applications overall functionality, and is often selected to appear vulnerable (such as
naming the cookie 'debug' or 'admin' and giving it a numerical or Boolean value). The "Cookie Parameter
Manipulation" incident is triggered whenever the fake cookie value changes its value.
Behavior: Modifying the inputs of a page is the foundation of a large variety of attack vectors. Basically,
if you want to get the backend server to do something different, you need to supply different input values
(either by cookie, query string, url, or form parameters). Depending on what value the user chose for the
input, the attack could fall under large number of vectors, including "Buffer Overflow", "XSS", "Denial of
Service", "Fingerprinting", "Format String", "HTTP Response Splitting", "Integer Overflow", and "SQL
injection" among many others. A common practice is to first spider the website, then test every single input
on the site for a specific set of vulnerabilities. For example, the user might first index the site, then visit
each page on the site, then test every exposed input (cookie, query string, and form inputs) with a list of
21