1

I am currently working on penetration test of a web site that uses an Apache HTTP server. To test a vulnerability which is related to mod_cgi module, I need to know whether this web site uses mod_cgi module of Apache or not? How can I determine this?

2

The first place to look is the server header. Depending on the server configuration it may report all enabled modules. Alternately you can use a specially formulated request which will provide a less reliable detection. The AddHandler directive allows a script to answer with a non 501 response to incorrect HTTP verbs. I'm using this technique in my Apache profiling script (aprof) from my lbmap project: https://github.com/wireghoul/lbmap

|improve this answer|||||
  • Thanks a lot for your answer. I want to use lbmap aprof tool to detect which Apache modules are used. I downloaded this project from github, but how can I use this tool? – lonelyDeveloper Mar 3 '15 at 11:14
  • You run it the same way you run any perl file. Also, was there a reason you had to detect mod_cgi first as opposed to simply running the exploit? – wireghoul Mar 20 '15 at 5:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.