Tag Info

New answers tagged

0

Unrestricted file uploads are only dangerous to the server if either 1) you can upload to an arbitrary location, or 2) convince the server software to process your file. The first lets you overwrite pieces of the server software with your own code, while the second lets you exploit vulnerabilities in the software (eg. buffer overflows). If the server ...


1

Possibly, yes. In many typical configurations, where servers have not had extensive security hardening, it would be possible. Factors that might permit this: The application server would naturally require a network path to the database server, therefore any firewall would be configured to allow connections. The application server is likely, in a typical ...


0

One option is to password protect the folder. This is using IIS 7 as an example: Open IIS Manager (start >> run >> inetmgr.msc) Go to the website where you want to password protect the folder. Click on the folder that you want to set to require a password. Double Click on Authentication, Disable Anonymous Authentication. Enable Basic Authentication.


1

There are circumstances where a HTTP server will return a list of supported methods for a given resource in its Allow response header, according to RFC 7231 (the new RFC for HTTP 1.1 semantics): First in the response to an OPTIONS request, either on a specific resource path, or on the special * path (which would mainly describe the capabilities of the ...


6

Per RFC2616, the OPTIONS method should return the supported methods. Keyword is should since this isn't always the case. As the prior posts have already pointed out each method needs to be tested separately to be sure.


6

As there are only few methods (OPTIONS, GET, HEAD, POST, PUT, DELETE, TRACE and CONNECT), you can use a script and nc to send a request to all allowed methods and parse the results: for method in OPTIONS GET HEAD POST PUT DELETE TRACE CONNECT ; do echo -e "\n\nTrying $method\n\n" echo -e "$method / HTTP/1.1\nHost: server-hostname\nConnection: ...


5

The only way to identify the methods supported by a web server is to try each one and evaluate the response to determine if it indicates the method is supported or not. You can't simply query to ask which methods it supports; it won't give you a list. That said, there are better tools than nc. Nmap and metasploit both support HTTP method scanning and ...


0

The first truth of Information Security is that there are some people you have to trust. Without that truth the whole discipline of Information Security turns into paranoid free-fall. May I suggest trusting your colleagues? In lieu of that, the best way to protect your "attack surfaces" is to Backup to multiple sources; some of which are write-once audit ...


1

Short version : there is no central / unique command to check this by default on linux .. but you could rely on several tools, depending on the kind of scanning that you would like to find : Fail2ban to parse log file (ssh server, web server, ftp, vpn, etc.) in order to find any brute force / irregular login attempt (and trigger some firewall rules) On ...


4

For Apache, the HTTP protocol is also a vector: A request like: GET /some/cgi () {(:);};xxx Will put () {(:);};xxx in the SERVER_PROTOCOL environment variable. So, to detect, it's important to look for the () { string anywhere in the request header, not only after a :\s*. Also, it's conceivable that a base64 user name in a Authorization header end up ...


1

HTTP status status message 403 means the client doesn't have the access rights, that's why you are getting this response. HTTP PUT methods requires authorization to give access to the server content. Since PUT is dangerous method, if proper security mechanism is not used to restrict the users. So if you want to put some content on the server so you must use ...


1

As GET data is passed via the environment variable in CGI request, that's why the shellshock attack uses HTTP GET request header to trigger the attack. There are other attack vectors are also possible to execute the attack like DHCP. In this, attacker can exploit the vulnerability by interacting with application that uses BASH environment variables and whose ...


2

In a CGI request, the POST or PUT data is passed via standard input, not an environment variable. Consequently, it can only be used as an attack vector if the CGI program being attacked specifically places all or part of the data in an environment variable before running bash -- something that's extremely rare for CGI programs to do.


0

I always recommend setting AllowOverride None on production servers and keeping the rewrite rules and other settings you need in the virtualhost orr httpd.conf. Having htaccess files enabled is both a significant performance issue and an even bigger security concern. In this case it won't prevent the attack from occurring, but it will stop the htaccess file ...


1

This error occurs when a browser encounters a certificate that it does not trust. By that I mean that the server's certificate is not installed as a trusted root certificate. These are handled different on a browser to browser basis, but generally the error message you see allows the user to add the un-trusted certificate to its trusted certificate store ...


0

You get this warning usually only if you access the https site directly. If you try to access https behind the scenes, that is by doing an XMLHTTPRequest, embedding an image etc it will not ask the user, but instead simply fail (and usually log something to console).


7

You can try looking if you can get the server to display a native error page. Error pages can be customized by a web developer, but when they aren't, they often reveal a lot of information about the web server. For example, this is the 404 Not Found error page of Apache 2.2.4 running on Unix: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> ...


-4

Why not just use nmap to detect what web server software is being used?


26

If a website does not use a custom built server to modify the HTTP headers, you can try by examining the order of arrangement in the HTTP response fields. From OWASP: Apache 1.3.23 server: HTTP/1.1 200 OK Date: ... Server: ... Last-Modified: ... ETag: ... Accept-Ranges: bytes Content-Length: ... Connection: ... Content-Type: text/HTML Microsoft IIS ...


2

They may only have access to the Apache user account, but there may be another exploit or misconfiguration on your particular system that would enable an attacker to elevate their privileges to those of root. Local privilege escalation happens when one user acquires the system rights of another user. Network intruders have many techniques for increasing ...


4

You are right that you gain access to the UID of the process/script you exploited. In the case of the Apache identity with no mandatory access control and no proper separation of developer and apache roles, you can: destroy or deface the websites run by your Apache change websites' code to leak all the user database at a fixed URL that you can then consult ...


0

You're correct. The risk is what information you provide to the server, or on the server. The attacker could modify it's SSH client to inject some kind of malicious data in it's responses. However, it would have to conform to the SSH spec in order to be processed correctly by your SSH client, and then also do something malicious. Which in my opinion ...


0

I had a similar setup for my production servers. The HTTP server load balancing was done by HAPROXY. I can recommend NGINX especially for the front facing server that will also handle SSL. Also I am not sure, what policy you are taking to transfer files to the host machines or getting terminal access. You probably need to think about opening up an SSH port ...


0

In /etc/apache2/sites-available/default, make sure you have AllowOverride All instead of AllowOverride None. With None, .htaccess files are not parsed/evaluated.


4

The HTTP request is for / (the index page of your webserver) with a query string of "search=<chunk of VBscript>" If you've got a vulnerable webserver (I don't know what makes a webserver vulnerable, but the "%00" in the URL makes me think it's related to inconsistent handling of null bytes), the script attempts to download and run "getsetup.exe", which ...


0

tl;dr: it is expensive it works if you have a waf that allows whitelisting + learning-mode automated whitelist-generation automated deployment-cycles and a full-blown testing/QA - environment that tests ANY new function and feature good regression-testing ...


4

Because web-server content changes frequently and it would be annoying to have to constantly add new files to a whitelist. For ASP.NET, it's a bit more work, but if this were a goal, tools could be written to whitelist .aspx files during deployment, so that no other .aspx files could be executed, no matter where they are located. But you don't ...


1

Yes. You can use OpenSSL to convert the certificate into different formats as required by the application / server. I've seen Apache / Tomcat configured a number of ways. Sometimes with a .pfx, sometimes with .pem files, and sometimes using the Java keystore. IIS typically uses .pfx files. With that being said, you want to make sure that your CA allows ...


1

Yes, you can buy one certificate and use it on unlimited number of servers. However, some servers may require you to convert the certificate and the private key into an appropriate format. You may look into documentation to find the details for each program.



Top 50 recent answers are included