Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

When pentesting it is useful to know when apache mod_rewrite is enabled. But when one comes across a web server that does not utilize PHP it is difficult to tell if mod_rewrite is enabled considering that URL redirection isn't very necessary. Is there any way to tell if it is enabled (remotely) without simply guessing common URL redirections?

share|improve this question
"When pentesting it is useful to know when apache mod_rewrite is enabled". Could you clarify where this comes from? Ideally, a well-configured mod_rewrite (especially in the rewrite, not redirect sense) shouldn't be detectable: it should only affect the internal dispatch of the request, shouldn't it? – Bruno May 1 '12 at 20:24
Exploits that rely on mod_rewrite being enabled like www.securityfocus.com/bid/19204. One ideally wouldn't want to run such an exploit during a pentest unless you were sure mod_rewrite was enabled. – Bhubhu Hbuhdbus May 1 '12 at 20:37
Agreed. If they didn't leave the version string in the responses (eg: ServerSignature Off ServerTokens Prod) or mod_status enabled you shouldn't be able to tell. – adric May 1 '12 at 20:38
Ah yes, but that's more of a mod_rewrite implementation bug than a problem with the fact that mod_rewrite and its features are used. This could happen to any piece of software. The fact that mod_rewrite is enabled isn't a problem, is it? (The fact that a buggy version of it is used is.) – Bruno May 1 '12 at 20:40
Yes but in the case that a buggy version of it is used, mod_rewrite needs to nonetheless be enabled. – Bhubhu Hbuhdbus May 1 '12 at 20:43
show 2 more comments

1 Answer

up vote 1 down vote accepted

You might be able to test for poorly configured mod_rewrite configurations.

  • Metasploit Proxy Bypass Scanner
  • Metasploit LDAP BO
  • w3af has a bug that doesn't handle mod-rewrite properly, so you can end up leveraging the bug to fuzz a site to determine if it has mod_rewrite enabled

Of course, these are probes that only work if mod_rewrite exists and is unpatched and configured in a certain way.

Otherwise, I'm not sure if one could detect what is supposed to be transparent...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.