Files are increasingly shared over HTTP: lightweight file-server software, WebDAV extensions to the web server, and managed file transfer (MFT) appliances for business exchange. These are attacked like web applications, through directory listing and traversal, file upload to code execution, and authentication bypass, with MFT appliances standing out as a repeated source of mass-breach exploit chains.
Subtopics#
- HTTP file servers: file-server software and autoindex.
- WebDAV: the HTTP file-management extension.
- Managed file transfer: enterprise MFT appliances.