T1190: Exploit Public-Facing Application
AI Answer
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device (Source: MITRE ATT&CK T1190)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1190 |
| Name | Exploit Public-Facing Application |
| Tactic | Initial Access (initial-access) |
| Platforms | Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, Exploit Public-Facing Application (T1190) is one of the highest-connectivity ATT&CK techniques: 75 MITRE STIX relationships reference this technique; 46 threat groups observed using it; 8 software families associated; 21 campaigns associated; 5 OpenTrojan content pages reference it. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1190). Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.
Detection
DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress) AN0219 Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container. AN0220 Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback. AN0221 Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection. AN0222 Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a …
Detection strategy text is from the MITRE ATT&CK official technique page (https://attack.mitre.org/techniques/T1190).
Mitigation
Vulnerability scanning involves the automated or manual assessment of systems, applications, and networks to identify misconfigurations, unpatched software, or other security weaknesses. The process helps prioritize remediation efforts by classifying vulnerabilities based on risk and impact, reducing the likelihood of exploitation by adversaries. This mitigation can be implemented through the following measures:
Proactive Identification of Vulnerabilities
- Implementation: Use tools like Nessus or OpenVAS to scan endpoints, servers, and applications for missing patches and configuration issues. Schedule regular scans to ensure timely identification of vulnerabilities introduced by new deployments or updates.
- Use Case: A scan identifies unpatched software, such as outdated Apache servers, which could be exploited via CVE-XXXX-XXXX. The server is promptly patched, mitigating the risk.
Cloud Environment Scanning
- Implementation: Use cloud-specific vulnerability management tools like AWS Inspector, Azure Security Center, or GCP Security Command Center to identify issues like open S3 buckets or overly permissive IAM roles.
- Use Case: The scan detects a misconfigured S3 bucket with public read access, which is remediated to prevent potential data leakage.
Network Device Scanning
- Implementation: Use tools to scan network devices for vulnerabilities, such as weak SNMP strings or outdated firmware. Correlate scan results with vendor advisories to prioritize updates.
- Use Case: Scanning detects a router running outdated firmware vulnerable to CVE-XXXX-YYYY. The firmware is updated to a secure version.
Web Application Scanning
- Implementation: Use dynamic application security testing (DAST) tools such as OWASP ZAP or Burp Suite to scan for common vulnerabilities like SQL injection or cross-site scripting (XSS). Perform regular scans post-deployment to identify newly introduced vulnerabilities.
- Use Case: A scan identifies a cross-site scripting vulnerability in a form input field, which is promptly remediated by developers.
Prioritizing Vulnerabilities
- Implementation: Use vulnerability scoring frameworks like CVSS to assess severity. Integrate vulnerability scanning tools with ticketing systems to assign remediation tasks based on criticality.
- Use Case: A critical vulnerability with a CVSS score of 9.8 affecting remote access servers is prioritized and patched first.
Tools for Implementation
Open Source Tools:
- OpenVAS: Comprehensive network and system vulnerability scanning.
- OWASP ZAP: Dynamic scanning of web applications for vulnerabilities.
- Nmap with NSE Scripts: Network scanning with scripts to detect vulnerabilities.
Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.
Related Software
- COATHANGER
- BOLDMOVE
- Siloscape
- ZxShell
- Qilin
- SoreFang
- sqlmap
- Havij
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- BlackByte
- GALLIUM
- Kimsuky
- Volt Typhoon
- APT41
- Salt Typhoon
- Dragonfly
- menuPass
- HAFNIUM
- MuddyWater
- FIN7
- Sandworm Team
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- FrostyGoop Incident
- SharePoint ToolShell Exploitation
- Operation MidnightEclipse
- Cutting Edge
- C0018
- ShadowRay
- Anthropic AI-orchestrated Campaign
- Operation Digital Eye
- HomeLand Justice
- SolarWinds Compromise
- SPACEHOP Activity
- Operation CuckooBees
Campaign associations are from MITRE ATT&CK STIX relationships.
Related Content
References
- https://attack.mitre.org/techniques/T1190
- https://cwe.mitre.org/top25/index.html
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-windows-smb-server-could-allow-for-remote-code-execution
- https://arstechnica.com/information-technology/2021/02/armed-with-exploits-hackers-on-the-prowl-for-a-critical-vmware-vulnerability
- https://www.recordedfuture.com/blog/esxiargs-ransomware-targets-vmware-esxi-openslp-servers
- https://www.wired.com/story/russia-ukraine-cyberattacks-mandiant
- https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem
- https://nvd.nist.gov/vuln/detail/CVE-2016-6662
- https://nvd.nist.gov/vuln/detail/CVE-2014-7169
- https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
- https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
- https://us-cert.cisa.gov/ncas/alerts/TA18-106A
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1190 Exploit Public-Facing Application. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1190 Exploit Public-Facing Application?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.