2KKUU7ita

280
Part V: Hacking Applications
Seeking Web Vulnerabilities
Attacks against unsecured websites and applications via Hypertext Transfer
Protocol (HTTP) make up the majority of all Internet-related attacks. Most
of these attacks can be carried out even if the HTTP traffic is encrypted
(via HTTPS or via HTTP over SSL) because the communications medium
has nothing to do with these attacks. The security vulnerabilities actually
lie within the websites and applications themselves or the web server and
browser software that the systems run on and communicate with.
Many attacks against websites and applications are just minor nuisances and
might not affect sensitive information or system availability. However, some
attacks can wreak havoc on your systems, putting sensitive information at
risk and even placing your organization out of compliance with state, federal,
and international information privacy and security laws and regulations.
Directory traversal
I start you out with a simple directory traversal attack. Directory traversal is a
really basic weakness, but it can turn up interesting — sometimes sensitive —
information about a web system. This attack involves browsing a site and
looking for clues about the server’s directory structure and sensitive files
that might have been loaded intentionally or unintentionally.
Perform the following tests to determine information about your website’s
directory structure.
Crawlers
A spider program, such as the free HTTrack Website Copier, can crawl your
site to look for every publicly accessible file. To use HTTrack, simply load it,
give your project a name, tell HTTrack which website(s) to mirror, and after
a few minutes, possibly hours (depending on the size and complexity of the
site), you’ll have everything that’s publicly accessible on the site stored on
your local drive in c:\My Web Sites. Figure 14-1 shows the crawl output of
a basic website.
Complicated sites often reveal more information that should not be there,
including old data files and even application scripts and source code.