CAPEC-85
AJAX Footprinting
This attack utilizes the frequent client-server roundtrips in Ajax conversation to scan a system. While Ajax does not open up new vulnerabilities per se, it does optimize them from an attacker point of view. A common first step for an attacker is to footprint the target environment to understand what attacks will work. Since footprinting relies on enumeration, the conversational pattern of rapid, multiple requests and responses that are typical in Ajax applications enable an attacker to look for many vulnerabilities, well-known ports, network locations and so on. The knowledge gained through Ajax fingerprinting can be used to support other attacks, such as XSS.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-85: AJAX Footprinting: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/85.html and https://cve.bz/cve/capec/85?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
[Send request to target webpage and analyze HTML] Using a browser or an automated tool, an adversary sends requests to a webpage and records the received HTML response. Adversaries then analyze the HTML to identify any known underlying JavaScript architectures. This can aid in mappiong publicly known vulnerabilities to the webpage and can also helpo the adversary guess application architecture and the inner workings of a system.
1 technique
- Record all "src" values inside script tags. These JavaScript files are compared to lists of files for known architectures. If there is a large match between the "src" values and architecture files, then it can be assumed that particular architecture is being used.
Prerequisites
The user must allow JavaScript to execute in their browser
Skills required
- Medium skill
To land and launch a script on victim's machine with appropriate footprinting logic for enumerating services and vulnerabilities in JavaScript
Resources required
None: No specialized resources are required to execute this type of attack.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Read Data | Confidentiality |
Mitigations
Design: Use browser technologies that do not allow client side scripting.
Implementation: Perform input validation for all remote content.
Weaknesses it exploits
- CWE-20 Improper Input Validation
- CWE-79 Improper Neutralization of Input During Web Page Generation
- CWE-86 Improper Neutralization of Invalid Characters in Identifiers in Web Pages
- CWE-96 Improper Neutralization of Directives in Statically Saved Code
- CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers
- CWE-116 Improper Encoding or Escaping of Output
- CWE-184 Incomplete List of Disallowed Inputs
- CWE-348 Use of Less Trusted Source
- CWE-692 Incomplete Denylist to Cross-Site Scripting
Recent CVEs with these weaknesses
- 9.6CVE-2026-108186
Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
- 4.9CVE-2026-105427
Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.
- 6.7CVE-2026-105426
Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.
- 4.3CVE-2026-123178
An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to the local network to execute unauthorized commands and modify the router’s software and functionalit…
- 6.3CVE-2026-125871
The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the…
- 8.1CVE-2026-12574
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure.
- 5.1CVE-2026-120350
The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker w…
- 4.8CVE-2026-120326
DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When the name is pure US-ASCII the header is built as attachment; filename="<name>" with the name inser…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
Examples
Footprinting can be executed over almost any protocol including HTTP, TCP, UDP, and ICMP, with the general go…
Footprinting can be executed over almost any protocol including HTTP, TCP, UDP, and ICMP, with the general goal of gaining further information about a host environment to launch further attacks. The attacker can probe the system for banners, vulnerabilities, filenames, available services, and in short anything the host process has access to. The results of the probe are either used to execute javascript (for example, if the attackers' footprint script identifies a vulnerability in a firewall permission, then the client side script executes a javascript to change client firewall settings, or an attacker may simply echo the results of the scan back out to a remote host for targeting future attacks) or to inform other data gathering activities in order to craft atta.
MITRE's words, unchanged: CAPEC-85 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.