Version: Next

Hacking web servers

Web server

System used for storing, processing, and delivering websites
Hosts web applications, allowing clients to access those applications
Implements client-server model architecture where client can be e.g. a browser or an API.

Document root
- Root directory of servable documents
- E.g. HTML, JS, image files...
Server root
- Root directory of all the code that implements the server.
- Stores configuration, log, and executable files
Virtual document tree
- Used when the original disk becomes full
- Located sometimes on different disk, possibly on a different machine
Virtual hosting is multiple sites on a single server
Web proxy
- Also known as HTTP proxy
- Server placed between the client and server
- All requests coming from the client go through the proxy to the server
  - instead of directly going to the server
Open-source Web Server Architecture
- Typically uses
  - Linux as an OS
  - Apache as a web server
  - MySQL as a database
  - PHP (LAMP) as principal components.
Internet Information Service (IIS)
- Web server application developed for Windows Server

Information gathering e.g.:
- Acquiring robots.txt to see directories/files that are hidden from web crawlers.
- Internet searches, WHOIS
- 📝 Testing HTTP methods
  - Checks for GET, HEAD, POST, OPTIONS, DELETE, PUT, CONNECT, TRACE
  - Risky methods are DELETE, PUT, CONNECT, TRACE and should be disabled
  - nmap --script http-methods <target>
Footprinting
- E.g.
  - List email addresses: nmap --script http-google-email
  - Enumerate common web apps nmap --script http-enum -p80
- Tools: Netcraft, HTTPRecon, ID Serve, HTTPrint, Nmap
- See also Banner grabbing
Mirror the target website to browse it offline
- Tools: • Wget • BlackWidow • HTTrack • WebCopier Pro • Web Ripper • SurfOffline
Discover vulnerabilities using e.g.:
- 📝 Nikto
  - Web-server scanner focusing on • misconfigurations • outdated/insecure files
  - Read more in Vulnerability analysis | Nikto
- Metasploit
  - Find, exploit and validate vulnerabilities
Perform session hijacking and password cracking attacks

Patch and update server regularly
Encrypt the traffic.
- See also Encrypting communication | Cryptography
Enforce code access security policy
Monitor logs
Use website change detection system
- Check server files with hash comparison and alert if any modifications has happened.
Filter traffic to SSH server
Default passwords and unused default accounts should be changed and disabled respectively.

Place web servers in separate secure server security segment on network
Recommend to have three layered web application network: Internet, DMZ, internal
- See also Multi-tier architecture | Hacking web applications
Place web servers in DMZ zone isolated from public network as well as internal network.
- See also Network security zoning | Network security
Each layer should have its own firewalls
- See also • Zone-based firewall | Firewall • Screened subnet firewalls | Firewall