CEH - Module 13: Hacking Web Servers

CEH Certified Ethical Hacker - Module 13: Hacking Web Servers

Learning Objectives

  • Summarize Web Server Concepts (LO#01)

  • Demonstrate Different Web Server Attacks (LO#02)

  • Explain Web Server Attack Methodology (LO#03)

  • Explain Web Server Attack Countermeasures (LO#04)

  • Summarize Patch Management Concepts (LO#05)

Web Server Concepts

  • Web servers are critical for organizations to establish their web presence.

  • A single vulnerability can lead to security breaches.

Web Server Operations

  • A web server is a computer system that stores, processes, and delivers web pages via HTTP.

  • Client-Server Communication:

    • A client initiates communication through HTTP requests.

    • The web server retrieves requested content from data storage or application servers.

    • The server responds with an HTTP response.

    • Error messages are generated if information isn't found.

  • Components of a Web Server:

    • Document Root: Stores critical HTML files for web pages of a domain.

      • Example: If the URL is www.certifiedhacker.com and the document root is "certroot" in /admin/web, then /admin/web/certroot is the directory address.

      • If the complete request is www.certifiedhacker.com/P-folio/index.html, the server searches for /admin/web/certroot/P-folio/index.html.

    • Server Root: Stores server configuration, error, executable, and log files.

      • Contains code that implements the server.

      • Subdirectories: -conf (configuration), -logs (logs), and -cgi-bin (executables).

    • Virtual Document Tree: Provides storage on a different machine or disk when the original is full.

      • It is case-sensitive and provides object-level security.

      • Example: For www.certifiedhacker.com/P-folio/index.html, the server can search /admin/web/certroot/P-folio/index.html if /admin/web/certroot is on another disk.

    • Virtual Hosting: Hosting multiple domains or websites on the same server, sharing resources.

      • Types: Name-based, IP-based, and Port-based hosting.

    • Web Proxy: Sits between the web client and server to prevent IP blocking and maintain anonymity.

Open-Source Web Server Architecture (LAMP)

  • Commonly uses Linux, Apache, MySQL, and PHP (LAMP software bundle).

    • Linux: Operating system providing a secure platform.

    • Apache: Handles HTTP requests and responses.

    • MySQL: Relational database used to store content and configuration.

    • PHP: Application layer technology used to generate dynamic web content.

IIS Web Server Architecture

  • Internet Information Service (IIS) is a Microsoft web server application for Windows.

  • Supports HTTP, HTTPS, FTP, FTPS, SMTP, and NNTP.

  • Components include HTTP.sys (protocol listener), WWW Service, and Windows Process Activation Service (WAS).

  • Functions include listening to requests, managing processes, and reading configuration files.

Web Server Security Issues

  • Attackers target software vulnerabilities and configuration errors.

  • Web servers are accessible from anywhere, making them vulnerable.

  • Poor configurations can create vulnerabilities, even with firewalls in place.

  • Organizational security includes multiple levels from stack 1 to stack 7.

  • Impact of Web Server Attacks:

    • Compromised user accounts

    • Website defacement

    • Secondary attacks from the website

    • Root access to other applications or servers

    • Data tampering and theft

    • Reputational damage

  • Common Goals Behind Web Server Hacking:

    • Stealing credit card details or sensitive credentials using phishing techniques

    • Integrating the server into a botnet for DoS/DDoS attacks

    • Compromising a database

    • Obtaining closed-source applications

    • Hiding and redirecting traffic

    • Escalating privileges

    • Attacks may be performed for curiosity, self-set intellectual challenges, or to damage an organization's reputation.

  • Dangerous Security Flaws:

    • Poorly trained system administrators can introduce vulnerabilities.

    • Inadequate knowledge, negligence, laziness, and inattentiveness pose threats.

  • Some common oversights:

    • Failing to update with latest patches

    • Using the same admin credentials everywhere

    • Allowing unrestricted internal and outbound traffic

    • Running unhardened applications/servers

  • Why are Web Servers Compromised?

    • Webmaster's Perspective: Exposing the LAN/corporate intranet to threats from the Internet, including viruses, Trojans, and data compromise. Bugs in software are common vulnerabilities.

    • Network Administrator's Perspective: Poorly configured web servers cause potential security holes in the LAN. Excessive control makes the web impossible to use. Careful configuration is required to recognize and authenticate legitimate users and assign distinct access privileges.

    • End User's Perspective: Active content (ActiveX controls and Java applets) can allow harmful applications to invade the user's system. Active content from a website displayed by the user's browser can be used as a conduit for malicious software to bypass the firewall system.

  • Common Oversights that Compromise Web Servers

    • Improper file and directory permissions

    • Installation with default settings

    • Unnecessary services enabled

    • Security conflicts with business' ease-of-use requirements

    • Lack of proper security policy, procedures, and maintenance

    • Improper authentication with external systems

    • Default accounts with default/no passwords

    • Unnecessary default, backup, or sample files

    • Misconfigurations in web server, OS, and networks

    • Bugs in server software, OS, and web applications

    • Misconfigured SSL certificates and encryption settings

    • Administrative or debugging functions enabled/accessible

    • Use of self-signed and default certificates

    • Not using dedicated server for web services

Web Server Attacks

  • Attackers use various techniques to compromise web servers.

DNS Server Hijacking

  • Attacker compromises the DNS server and changes the DNS settings, redirecting requests to a malicious server. When a user enters a legitimate URL, they are redirected to the attacker's fake site.

DNS Amplification Attack

  • Attackers exploit the DNS recursive method of DNS redirection to perform DDoS attacks.

  • Recursive DNS query: A method of requesting DNS mapping that goes through DNS servers recursively until the mapping is resolved.

  • Steps in Processing Recursive DNS Requests:

    • User sends DNS query to primary DNS server.

    • If the mapping doesn't exist, the server forwards the request to the root server, then to the .com namespace, repeating recursively until resolved.

    • The system finds the primary DNS server for the requested mapping and generates a cache for the IP address in the user's server.

  • Attackers instruct compromised hosts (bots) to make DNS queries in the network and spoof the victim's IP address, sending requests to the primary DNS server. The replies to these requests result in DDoS on the victim's DNS server.

Directory Traversal Attacks

  • Attackers exploit HTTP to access restricted directories and execute commands outside the web server's root directory by manipulating a URL.

  • Attackers use the ../ (dot-dot-slash) sequence to access restricted directories.

  • Vulnerability in web application code or poorly patched/configured web server software can make a web server vulnerable to a directory traversal attack.

Website Defacement

  • Unauthorized changes made to the content of a single web page or an entire website. Attackers break into web servers and alter the content, changing the visual appearance of the website. Defaced pages expose visitors to propaganda or misleading information.

  • Attackers use methods such as MySQL injection to access a website to deface it.

  • Website defacement not only embarrasses the target organization but also harms its visitors by infecting their computers.

Web Server Misconfiguration

  • Configuration weaknesses in web infrastructure can be exploited to launch attacks such as directory traversal, server intrusion, and data theft.

  • Examples of Web Server Misconfigurations:

    • Verbose debug/error messages

    • Anonymous or default users/passwords

    • Sample configuration and script files

    • Remote administration functions

    • Unnecessary services enabled

    • Misconfigured/default SSL certificates

  • Improper configurations provide attackers a path to enter an organization's target network and bypass user authentication.

HTTP Response-Splitting Attack

  • A web-based attack where the attacker tricks the server by injecting new lines into response headers, along with arbitrary code.

  • It involves adding header response data into the input field so that the server splits the response into two responses.

  • This attack exploits vulnerabilities in input validation. Examples include Cross-site scripting (XSS), cross-site request forgery (CSRF), and SQL injection.

  • The attacker can control the first response to redirect the user to a malicious website.

Web Cache Poisoning Attack

  • Damages the reliability of an intermediate web cache source.

  • Attackers swap cached content for a random URL with infected content so Users of the web cache source may unknowingly use the poisoned content.

  • Attackers force the web server's cache to flush its actual cache content and sends a specially crafted request to store in cache.

  • Web cache poisoning attacks are possible if the web server and application have HTTP response-splitting flaws.

SSH Brute Force Attack

  • Attackers use SSH protocols to create an encrypted SSH tunnel between two hosts to transfer unencrypted data over an insecure network. SSH runs on TCP port 22.

  • With a brute-force attack, the attacker obtains login credentials to gain unauthorized access to an SSH tunnel to transmit malware and other means of exploitation to victims without being detected.

Web Server Password Cracking

  • An attacker attempts to exploit weaknesses to hack well-chosen passwords. The most common passwords found are password, root, administrator, admin, demo, test, guest, qwerty, pet names, and so on.

  • Attackers mainly target SMTP and FTP servers, Web shares, SSH tunnels, and Web form authentication.

  • Attackers use different methods such as social engineering, spoofing, phishing, a Trojan horse or virus, wiretapping, and keystroke logging.

  • Web Server Password Cracking Techniques

  • Attackers can crack passwords either manually or with automated tools such as THC Hydra, Ncrack, and RainbowCrack.

  • Techniques to Crack Passwords:

    • Guessing: The attacker guesses possible passwords either manually or by using automated tools including dictionaries. Most people use weak easy-to-remember passwords.

    • Dictionary Attack: A dictionary attack uses a predefined file containing various combinations of words and enters these words one at a time to check if any of them are the password. This is less time consuming than a brute-force attack.

    • Brute-Force Attack: All possible character combinations are tested. If a password consists of uppercase and lowercase letters as well as special characters, it might take months or years to crack the password.

    • Hybrid Attack: More powerful than other techniques because it uses both a dictionary attack and brute-force attack and also uses symbols and numbers.

Other Web Server Attacks

  • DOS/DDoS Attacks: Attackers flood targets with copious fake requests so that the target becomes unavailable to legitimate users.

  • Man-in-the-Middle Attack: Attackers access sensitive information by intercepting and altering communications between an end user and web servers.

  • Phishing Attacks: Attackers trick the user into submitting login details for a website that looks legitimate and redirect them to the malicious website hosted on the attacker's web server.

  • Web Application Attacks: Even if web servers are configured securely, a poorly coded web application deployed on the web server may provide a path for an attacker to compromise the web server's security.

    • Server-Side Request Forgery (SSRF) Attack: Attackers exploit server-side request forgery (SSRF) vulnerabilities to send crafted requests to the internal or backend servers.

    • Parameter/Form Tampering: The attacker manipulates the parameters exchanged between the client and server to modify application data.

    • Cookie Tampering: Different types of tools help in modifying persistent and non-persistent cookies.

    • Unvalidated Input and File Injection Attacks: These attacks are performed by supplying an unvalidated input or by injecting files into a web application.

    • Session Hijacking: An attack in which the attacker exploits, steals, predicts, and negotiates the real valid web session's control

    • SQL Injection Attacks: The attacker injects malicious code into the strings, which are later passed on to the SQL server for execution.

    • Directory Traversal: Exploitation of HTTP through which attackers can access restricted directories and execute commands outside of the web server's root directory by manipulating a URL.

    • Denial-of-Service (DoS) Attack: An attack is intended to terminate the operations of a website or server to make it unavailable for access by its intended users.

    • Cross-Site Scripting (XSS) Attacks: The attacker injects HTML tags or scripts into a target website.

    • Buffer Overflow Attacks: An attacker floods the application with an excess amount of data.

    • Cross-Site Request Forgery (CSRF) Attack: An attacker exploits the trust of an authenticated user to pass malicious code or commands to the web server.

    • Command Injection Attacks: A hacker alters the content of the web page by using HTML code and identifying the form fields that lack valid constraints.

    • Source Code Disclosure: This occurs because of typographical errors in the scripts or misconfiguration.

Web Server Attack Methodology

  • The attack methodology involves preplanned activities that an attacker follows to reach the goal of breaching the target web server's security. Attackers try to gather information about loopholes to gain unauthorized access to the web server.

  • Stages in an Attack Methodology:

    1. Information Gathering: Attackers collect as much information as possible about the target.

    2. Web Server Footprinting: Gathering information about the security aspects of a web server with the help of tools or footprinting techniques.

    3. Website Mirroring: Copying a website and its content onto another server for offline browsing.

    4. Vulnerability Scanning: Finding the vulnerabilities and misconfigurations of a web server with automated tools.

    5. Session Hijacking: Taking complete control over the user session.

    6. Web Server Passwords Hacking: Attackers use password-cracking methods (brute-force, hybrid, dictionary) to crack the web server's password.

Information Gathering

  • Attackers use various tools and techniques to collect as much information as possible about the target server.

  • Attackers can use tools such as who.is and Whois Lookup to extract information such as the target's domain name, IP address, and autonomous system number.

  • Retrieving information from the robots.txt file helps to enumerate the directories and files the web site owner wants to hide from web crawlers.

Web Server Footprinting/Banner Grabbing

  • Attackers gather valuable system-level data, such as account details, operating systems, software versions, server names, and database schema details, to enumerate a web server.

  • Tools:

    • Netcat: Networking utility that reads and writes data across network connections using TCP/IP protocol.

    • Telnet: Telnet is a client-server network protocol that is widely used on the Internet or LANs.

    • httprecon: Tool for advanced web server fingerprinting. It performs banner-grabbing attacks, status code enumeration, and header ordering analysis.

    • ID Serve: Simple Internet server identification utility.

Enumerating Web Server Information Using Nmap

  • Nmap, along with the Nmap Scripting Engine (NSE), can extract a large amount of valuable information from the target web server.

  • Along with commands, NSE provides scripts that reveal various types of useful information about the target server to an attacker.

Website Mirroring

  • Website mirroring copies an entire website and its content onto a local drive, mapping the directory structure and external links.

  • Attackers can search the comments and other items in the HTML source code of downloaded web pages.

  • Example Tools: WebCopier Pro, HTTrack Web Site Copier, Website Ripper Copier, and Cyotek WebCopy.

Finding Default Credentials of Web Server

  • Many web server administrative interfaces are publicly accessible and in the web root directory.

  • Often, these administrative interface credentials are not properly configured and remain set to default.

  • Techniques to identify the default login credentials include:

    • Consulting the administrative interface documentation to identify default passwords

    • Using Metasploit's built-in database to scan the server

    • Using online resources like Open Sez Me and cirt.net to identify the default passwords

    • Attempting password-guessing and brute-forcing attacks

Finding Default Content of Web Server

  • Most servers of web applications have default contents and functionalities that can allow attackers to launch attacks.

  • Tools: Nikto2 vulnerability scanner.

Finding Directory Listings of Web Server

  • When a web server receives a request for a directory, rather than a file, the web server directory listings do not have significant relevance from a security perspective but are occasionally involved in web app compromises

  • Tools: Dirhunt web crawler.

Vulnerability Scanning

  • A vulnerability scan to implement consists of:

    • Identifying hosts, services and vulnerabilities of the server using automated tools like Acunetix

    • Sniffing the network traffic to identify any active systems, network services and existing vulnerabilities within the server.

    • Implementation of an acunetix scan

Finding Exploitable Vulnerabilities

  • Repositories, such as Packet Storm and Exploit Database, allows finding and fixing of software vulnerabilities.

  • Exploiting these vulnerabilities allows attackers to execute code, escalate privileges, or bypass security mechanisms.

Session Hijacking

  • Sniff valid session IDs to gain unauthorized access to the web server to snoop data.

  • Use tools, such as, Burp Suite, JHIJack and Ettercap for Session hijacking.

Web Server Password Hacking

  • Attackers use every possible password cracking techniques to extract passwords, including dictionary, as well as manual and automated tools like Hashcat and THC Hydra

Using Application Server as a Proxy

  • Attackers configure the application server to use GET and CONNECT calls/requests to connect and obtain target specific information from vulnerable web servers.

Web Server Attack Tools: Metasploit

  • An open-source exploitation framework used by security researchers and penetration testers with a uniform model for the rapid development of exploits, payloads, encoders, no operation (NOP) generators, and reconnaissance tools.

  • Achieved through:
    * Closed loop vulnerability validation
    *Phishing Simulations
    *Social engineering
    * Evade- leading defensive solutions

Web Server Attack Countermeasures

Place Web Servers in Separate Secure Server Security Segment on Network

  • The best practice involves designing a network into at least three segments: the internet, a secure server security segment that may be termed a DMZ and an internal network.

    • By securing the servers in DMZ using multiple layers, the outside and insiders attacks can be reduced and thwarted.

    • Network separation can be done enforcing firewalls and security rules based on the different level of security desired.

Countermeasures: Patches and Updates

  • Following measures need to be in place for patching:

    • Regular and scheduled scan and update of the server and available software.

    • Reading, assessment and review by security department team of all releases before implementation

    • Keep a fall back or a back out planned to allow for failure situations/issues and also regularly check the endpoints, services and dependencies

    • Have an alerting system patch deployment with patch management software.

    • Make a standardized patch deployment plan as part of Software Development Life Cycle or SDLC.

Countermeasures: Protocols

  • A set of secure measures to improve network usage, ensure TCP/IP hardening, and protect insecure and non interactive accounts include:

    • Blocking of unnecessary ports, ICMP traffic, and unnecessary protocls.

    • Limiting network access to all internal network traffic

    • Restricting administrator root level access and maintaining records.

    • Using OpenVPN to securely access multi-server platforms with data encryption.

    • Using password management software like KeePass and enforcing password expiry related policies, while allowing for account lock features using the principles of 2FA OR MFA.

Countermeasures: Files and Directories

  • These includes implementing sandboxes and proper validation while removing meta characters and maintaining file checkers to avoid directory listings as well as data filtration.

Detecting Web Server Hacking Attempts

  • Use a Website Change Detection System (WDS), that goes through all your web folders, detects any changes made and automatically provides alerts when these changes are detected.

How to defend against Web Server Attacks

  • Regular auditing of server ports to protect unnecessary traffic flow to web server traffic.

  • Guarantee security through implementing server certificates, while using restricted permission settings, code access security, and minimal level of auditing.
    Implementation of machine.config for ensuring secure data information by changing all machine settings based on the required code levels.

  • Other safety measures

    • Security of SAM

    • File relocation to non-system partition

    • Use dedicated machine as web server and ensure all new IIS server have been hardened completely as well protected by an anti-bot mitigation strategy tool tool

How to Defend against HTTP Response-Splitting and Web Cache Poisoning

  • Utilize the latest version of HTTP server to apply restrictions unique to IPs while carefully removing any unnecessary HTTP response contents during data transfer using up-to-date third party testing tools, UDP for random forgery attacks and RFC specs for server configuration

How to Defend against DNS Hijacking

  • Strong user policies to improve security and avoid public DNS and implement new user VPN service using a reliable vendor
    Implementation of DNSSEC to enhance security in traffic communication

Web Application Security Scanners

Implement high code security and server web through utilities like:
* Syhunt Hybrid for vulnerability identification.
* N-Stalker X for SQL traffic enumeration.
* Fortify WebAspect high risk bug maintenance-Qualys, to improve general security levels

Web Server Security Scanners

  • WordPress Security Scan

  • Nikto 2, to improve overall code reliability

    • Qualys, to implement assessment in external facing software

Web Server Malware Infection Monitoring Tools

  • Implementation of detection and quality traffic measurement solutions through Qualys Guard to maintain an effective and high malware detection score

Web Server Pen Testing Tools

Implementation of testing tools, to improve internal web application structure based on exploitation report results generated with tools like Core Impact
( or the similar Immunity CANVAS.
The use of the following tools: Arachni •,WebSurgery, Mitmprox ,Webalizer are also recommended here.

Patch Management

  • A patch is a small change to fix problems and improve security while Hotfixes provide quick solutions to specific issues, implemented through various system patches and hotfixes across diverse network environments using automated tools to scan and verify and report known vulnerabilities against system or data

What is Patch Management?

  • Automating various tools for reporting issues with the systems (such as

    • Detecting

    • Assessing

    • Acquiring

      • Testing and

        • Deploying
          and Reporting functions

Installation of a Patch

  • The best strategy involves an analysis process to decide whether to make any change, while using safe installation approaches and keeping track of both manual and automatic implementations to enable source analysis

Patch Management Tools to Improve Data Protection:

Implementation of management tools like GFI LanGuard for scheduled data access tracking with vulnerability monitoring