7

Scenario

You need to PenTest XYZ.com.

You expect, because it is a high traffic site, that multiple servers are being used with a load balancer.

Question

Aside from pulling the MACs (which are obviously different) of the "balanced" servers, how can you detect balancing?

Improve this question
1
  • Please don't say Halberd or lbd. I want to know more detail regarding what information is available at what layers - these tools obfuscate the problem too much for me.
    – gal
    Feb 10, 2013 at 22:22

3 Answers 3

Reset to default
14

Properly implemented, load balancing can be totally transparent; you may need to rely on other means (such as hunting though job ads for the company) to try guess at likely products.

However there are a few things you can check that at least imply the existance of a balancer:

  • The HTTP headers may reveal the presense of a proxy server or other balancer.
    • Check here for different timestamps as well, implying slightly different clocks.
    • Check the order of the headers as well.
  • Observe the system under load
    • Generate a ton of traffic; see if your requests start going somewhere else, or if the headers change, etc.
  • General reconnaisance
    • The DNS response may reveal multiple IP addresses, implying balancing.
    • They may give it away in the hostname (cdn.xyz.com)
    • You may be able to get some more info from netcraft.com that leads you in the right direction

The manual for halberd contains a good list of concepts that it uses (Date comparison; MIME header field names, values and their order; Generating high amounts of traffic; Using different URLs; Detecting server-side caches; Obtaining public IP addresses).

Using halberd or ldb is likely your best option in a practical situation - a lot of these tests are time consuming and finicky, so you likely want to automate all the busy work.

Improve this answer
4
  • Where available, the ETag: header is usually a good indicator, since it's often not correctly configured for a load balanced set up. It's also useful to probe from different IP blocks, and ideally via different ISPs.
    – mr.spuratic
    Feb 11, 2013 at 12:18
  • A common misconfiguration is also to send relatively uncommon client-specific headers from the server, such as If-Unmodified-Since or Upgrade - because the balancer saw them when it made its internal request and just faithfully passes them on. This will likely only apply to older devices though, as they're not holes that tend to stay in the default config for more than a couple of generations.
    – Bob Watson
    Feb 11, 2013 at 21:26
  • If we use tracert command in windows, it will tell about the different IP it traverses till final ip. So with this also, we can identify whether it is directly hitting the webserver or through any other
    – Anto Varghese
    Jun 21, 2016 at 9:27
  • // , Does Load Balancing increase security?
    – Nathan Basanese
    Nov 1, 2018 at 17:48
4

A few possible ways you can determine if a site is using a load balancing are:

  • You can search for the addition of non-standard webserver cookies and headers which are commonly used by load balancers to assist applications with handling sessions and other security functions.

  • There is also a chance that you may do an nslookups or do traceroutes and retrieve the public ip addresses used for load balancing if more
    then one is used.

  • If all else fails you may be able to find the architecture of the
    site in a technical post from an interview that was done with the
    staff of the large website or ask the site's webhost.

Improve this answer
2
  • What's non standard about them? they're session cookies right?
    – mgjk
    Feb 11, 2013 at 16:24
  • A non-standard cookie could be one that was not added by the web application or server in a single server setup that would help give away that the site is behind a load balancer. The headers may also be different and set to a non-standard webserver that is specific to load balancers.
    – ITOps
    Feb 11, 2013 at 21:47
4

More load balancing detection methods:

  • Many load balancers use cookies. The cookie helps to determine which server to use. The load balancer sets a cookie in the browser recording the server the request is sent too. As new requests come in, the balancer reads the cookie and sends the request to the same server. Examples of cookies referencing network infrastructure are Cisco CSS and Big-IP.

  • Often SSL configuration will differ between servers, and that indicates multiple servers. SSL ciphers or version support levels may differ. SSL certificates may be issued to individual servers instead of the load balanced name. This method doesn't always work because large websites use SSL accelerators as front-ends to their load balancers.

  • Some web applications insert HTML comments or tags that indicate multiple servers. This is used to assist with troubleshooting which server has the issue. The tags can be obvious like server1, host502web or cryptic messages like known only to insiders.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .