Skip to main content
Version: Next

Web server threats and attacks

DoS/DDoS attacks​

  • Flooding server with large number of requests to prevent it from functioning properly.
  • Services targeted include
    • network bandwidth
    • memory
    • application exception handling mechanism
    • database / hard disk space
    • CPU usage
  • DDoS is distributed DoS (denial of service) attack using more than single machine (bots)

DNS server hijacking​

  • DNS (Domain Name System)
  • Attacker compromises a DNS server and change its DNS server to redirect clients to a malicious website.
    • E.g. by configuring DNS server to redirect requests to a rogue DNS server.
  • E.g. user types in legitimate URL in a browser but browser redirects to a fake banking site.
  • See also DNS poisoning | Sniffing attacks

DNS server hijacking countermeasures​

DNS amplification attack​

  • A DoS attack is to overwhelm the victims DNS server.
  • Includes sending large number of requests to DNS server using target websites IP address.
  • Query goes through DNS servers recursively until DNS server fails to find the mapping.

Recursive DNS lookup​

  • Client asks for a mapping DNS server does not have
  • DNS server queries further the root DNS server and then caches the results

DNS amplification attack flow​

  1. Attacker spoofs and uses victims IP address as source IP
    • All replies from DNS server will be sent to the victims servers
  2. Attacker finds internet domain with many DNS records
    • E.g. subdomain1.cloudarchitecture.io, subdomain2.cloudarchitecture.io, subdomain3.cloudarchitecture.io...
  3. Attacker sends DNS queries (using bots) to get all records for the domain
    • Results in large replies (usually split over several packets)
    • The replies are sent to the victim.
      • Victims web server becomes too busy with receiving and merging packets and stops functions.
    • Amplification
      • For each short DNS query, DNS server replies with larger response
      • Sometimes up to x100 larger, e.g. 3 MBPS DNS queries is amplified as 3000 MBPS DNS replies to victim.

Directory traversal attacks​

  • Manipulating the target URL to gain access to restricted directories.
  • Attackers may reach to restricted directories using ../.
  • Can be caused by e.g. code vulnerabilities (such as no proper validation), or poorly patched/configured web servers.

Man-in-the-middle (MITM) attacks​

  • Intercepting/altering the traffic between an end-user and web servers.
  • Done by tricking client into thinking the attacker is the proxy.
  • Allows attacker to steal sensitive information.
  • This often uses IP spoofing to trick a victim into connecting to the attack.

Phishing attacks​

Website defacement​

Web server misconfiguration​

  • Configuration weaknesses that are exploited.
  • E.g. directory traversal, server intrusion, and data theft.
  • E.g. Capital One misconfiguration that led to compromising more than 100 million peoples personal data in 2019 (read more)
  • "Keeping the server configuration secure requires vigilance"— OWASP

HTTP response splitting attack​

  • Occurs when HTTP headers are generated dynamically using user input.

    • exploits input validation vulnerability.

  • Attacker passes malicious data to a vulnerable application

    • and the application includes the data in an HTTP response header.

  • Exploited by injecting new lines into response headers e.g.:

    • Author variable is sent by user such as Ulle Bulle

    • Application sets Set-Cookie author=Ulle Bulle header in back-end.

    • If user sends following instead (with a newline) he can manipulate the website behavior:

          Ulle Bulle\r\n
          Content-Type: text/html\r\n
          <html>malicious content...</html>

  • Permits variety of attacks such as

Defend against HTTP response splitting attack​

  • Server admin
    • Use latest web server software.
    • Regularly update/patch OS and Webserver.
    • Run web vulnerability scanners.
  • Application developers
    • Restrict web application access to unique IPs.
    • Disallow carriage return (%0d or \r) and line feed (%0a or \n) characters.
    • Comply to RFC 2616 specifications for HTTP/1.1.
  • Proxy servers
    • Avoid sharing incoming TCP connections among different clients.
    • Use different TCP connections with the proxy for different virtual hosts.
    • Implement "maintain request host header" correctly.
    • See also Proxy servers | Bypassing IDS and firewall

Web cache poisoning​

Web cache poisoning flow​

  1. Find the service code that vulnerable to filling the HTTP header field with many headers.

  2. Force the cache server to flush its actual cache content

    • E.g. by sending Pragma: no-cache or Cache-Control: no-cache headers in a request.

  3. Send a specially crafted request to store in cache

    • Inject malicious code using HTTP response splitting

    • E.g. GET request where encoded URI does the splitting

        GET http://cloudarchitecture.io/redir.php?site=%0d%0aContent-
        Length: %200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aLast-
        Modified: %20Mon,%2027%20Oct%202009%2014:50:18%20GMT%0d%0aConte
        nt-Length: %2020%0d%0aContent-
        Type: %20text/html%0d%0a%0d%0a<html>deface!</html> HTTP/1.1
        Host: cloudarchitecture.io
        ...

  4. Send the next request.

    • Previously injected content will be the response as it's cached.

SSH brute force attacks​

  • Done by cracking SSH login and using SSH tunnels.
  • Flow
    1. Acquire the SSH login credentials
      1. Port scan to find possible vulnerabilities (e.g. using nmap)
      2. Gain login credentials using brute force attack by e.g.
        • Using metasploit with auxiliary/scanner/ssh/ssh_login
        • Using hydra as hydra -L users.txt -P passwords.txt ssh://172.16.1.102 -t 4
        • Using custom script in nmap e.g. nmap 172.16.1.102 -p 22 --script ssh-brute --script-args userdb=users.txt,passdb=passwords.txt
    2. Create SSH tunnels between two hosts to transfer exploitations.
  • See also SSH | Tunneling protocols

Web server password cracking attacks​

  • Attacker cracks the target server passwords and uses them to perform new attacks.
  • Server password can belong to e.g. SMTP and FTP servers, Web shares, SSH tunnels...
  • Attacking methods include social engineering, spoofing, phishing, using a trojan horse or virus, wiretapping, keystroke logging.
  • See also Password attack types | Cracking passwords

Web server password cracking tools​

Cain and Abel​

Web application attacks​

Buffer overflow attacks​

  • Also known as buffer overrun

  • Anomaly that happens when web server writes data to a buffer in memory that's bigger than buffer size.

    • May cause application crash or other vulnerable behavior.

  • Exploited by attacker through sending data in big sizes to the server.

  • 📝 Example attack against a local server:

      #!/usr/bin/python
      import socket

      big_data = 5000 * 'A'
      payload = "TRUN /.:/" + big_data
      s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
      s.connect("10.0.2.4", "9999")
      s.send(payload)
      print "[+] " + str(len(payload)) + " bytes sent"
      s.close()

  • Memory manipulation functions in C and C++ without bound checking are most vulnerable.

    • Higher level languages like Python, Java, and Swift do a better job of protecting against a buffer overflow, but they are still vulnerable.

  • Dangerous SQL functions (without checking size of destination buffers) include • gets() • strcpy() • stract() • printf()

NOP Sled​

  • Oldest and most common way of exploiting stack buffer overflows
  • Sends a large # of NOP instructions into buffer.
  • Solves the problem of finding the right place for code execution, as NOPs does nothing and target area is big the execution will slide to no-ops where malicious code will be executed.
  • Most IDS protect from this attack.