0

I've recently been doing some research on pentesting websites through metasploit. Now I've run into a problem that I'm sure is pretty common but I cant seem to find anything else about it on stackexchange.

Say that I am trying to access pentest.com through metasploit and that website is hosted on a service like Cloudfare. Lets say that Cloudfare also hosts johnsbaking.com on the same server. pentest.com and johnsbaking will share the same IP - which would mean that connecting to the IP adress would not actually access the needed website.

So it would seem that the different websites are accessed through different ports(or maybe not?)...but how would one tell which port is being used for which website? Keep in mind that cloudfare does not allow access to a website through ip adress and port in a browser.

  • This isn't really a security question. One of the other stack exchange sites might have been a better place. – Bryan Field Sep 22 '16 at 1:00
  • Your assumptions aren't quite right: 1. a server can have many network cards 2. a network card can have many IP addresses. Also, related to sharing HTTPS site on same socket, see Server Name Indication (SNI) – Neil McGuigan Sep 22 '16 at 1:03
  • Possible duplicate: serverfault.com/questions/106882/… – Arminius Sep 22 '16 at 1:04
1

In your example the target website is determined by the HTTP Host header, not the TCP port.

On the transport layer it is indistinguishable whether you want to connect to pentest.com or johnsbaking.com. (I assume you implicitly choose the default port which is either 80 for HTTP or 443 for HTTPS.)

Your web browser sends the target host name on the application layer as part of the HTTP protocol. This information is communicated via the Host header. How the header works is detailed in this answer. So instead of setting a different port, you need to exchange the IP with the host name in metasploit.

0

All HTTP traffic is routed through port 80, and HTTPS traffic to port 443.

When the browser connects, and sends an HTTP Request, one of the HTTP Request Headers is called Host and that indicates the desired website.

By looking at the Host header, the webserver can determine the desired website. An unlimited number of separate websites can be served from a single IP.

This is in contrast to some services such as Anonymous FTP, where there is no Host header, so a dedicated IP must be used, or use a login.

Sometimes Port Forwarding is used, if there are multiple WAN IP addresses but only one server on the LAN. In this case, even though the server may run webservers on multiple ports, the WAN (public facing) still only uses port 80. (and 443)

Finally it is worth noting that a user can manually select a different port using : syntax. For example http://security.stackexchange.com:80 is the default. I could also try http://security.stackexchange.com:81, but this will not work unless there is a webserver running on that particular port 81.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.