3

I've set up Nginx as a reverse proxy server that points to an Apache server remotely. Of course IPs are different and let's suppose that I'm only running an HTTP service on that server.

How can an attacker find the IP of the server who's serving the content, in my case Apache?

Improve this question
1
  • 1
    If properly done an attacker cannot find out the real IP. But based on this few information it is unknown if this is properly done or if for example the served content or served error messages contain the hidden hostname or IP address.
    – Steffen Ullrich
    Jan 15, 2017 at 18:09

2 Answers 2

Reset to default
4

It depends. A reverse proxy, if set correctly, will not reveal information about the web server it points to.

However, there are a lot of things a determined attacker can do to gain information about the origin server:

DNS tricks

Your A records surely point to the reverse proxy, but are there other records (typically MX or any other subdomain) that directly point to the original server?

In CDN setups, it's not uncommon to have an 'origin' subdomain that points to the actual server. Sure, you can obfuscate the origin by using a non-guessable name but then often DNS misconfigurations like AXFR vulnerabilities can reveal such domain names.

Configuration Errors

Various configuration errors or settings on the reverse proxy side as well as on the Apache side can leak the web server's IP address. Some web servers enable the mod-info module which essentially exposes the Apache status page to the internet. A quick Google query reveals many servers with such instances. It's remarkable how many of these exhibit the exact same leakage you are worried about. For example, check out this site in the Google query results. The DNS points to the reverse proxy, but the page shows the internal web server IP.

Apache server status web page

Application Errors

It's not uncommon for the application itself to reveal the internal IP addresses. For example, can one trigger a SQL error or an 'Internal Server Error' on the application and get the error message to reveal the IP address of the server?

Application Vulnerabilities

If the application has vulnerabilities like remote command execution or remote file inclusion then it is totally possible to know the IP address (and a lot more). For example, for a vulnerable PHP application a simple <? phpinfo(); ?> command will spit out everything about the server, including its internal IP address. Similar tricks will work for other frameworks/languages.

Other tricks

There are various other tricks/leakages that might happen. The following article illustrates various ways it can leak:

https://zeroknock.blogspot.com/2013/07/internal-ip-address-disclosure-over.html

I've also in the past been successful in getting the origin IP address via https://censys.io/

Improve this answer
2
  • 2
    Another big one is any sort of email interaction (registration, reset password, etc), where many times it will be in the SMTP headers.
    – movsx
    Jan 16, 2017 at 0:34
  • Worth looking also at James Keetle's HTTP Hidden Attacks Study covering various ways of finding hidden servers, usually making these server ring a specific bell (like DNS entries, referrers hidden pages, etc.)
    – regilero
    Mar 5, 2018 at 13:38
2

If the reverse proxy does not set any HTTP headers that leak this information (typically thinking about X-Forwarded-For), then it's not possible to track the original webserver without gaining access to the proxy itself or capturing unencrypted packets between the proxy and the webserver.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .