SQL Injection Attacks and Defense - 2009

406 Chapter 9 • Platform-Level Defenses
Use an Empty Default Web Site
The HTTP/1.1 protocol requires HTTP clients to send the Host header in the request to
the Web server. To access a specific Web site, the header value must match the host name in
the Web server’s virtual host configuration. If a match is not found, the default Web site
content will be returned. For example, attempting to connect to a Web site by Internet
Protocol (IP) address will result in the content of the default Web site being returned.
Consider the following example:
GET / HTTP/1.1
Host: 64.233.169.104
…
Google
Here a request has been made to 64.223.169.104, which is actually an IP address
of a Google Web server. What is returned by default is the familiar Google search page.
This configuration makes sense for Google because Google likely doesn’t care whether it
is being accessed by IP address or host name; Google wants everyone on the Internet to
use its service. As the owner of an enterprise Web application, you may prefer a little more
anonymity and would like to avoid discovery by attackers scanning your IP address range
for ports 80 and 443. To ensure that users are connecting to your Web application by host
name only, which usually takes the attacker more time and effort to dig up (but is known
to your users), configure the Web server’s default Web site to return a blank default Web
page. Given that legitimate users usually prefer easy-to-remember host names, access
attempts via IP address could be a good way to detect potential intrusion attempts. Lastly,
it’s worth pointing out that this is a defense-in-depth mechanism and is not sufficient to
prevent unwanted discovery, but it can be especially effective against automated scanning
programs (such as vulnerability scanners or even SQL injection worms) looking to identify
vulnerable Web sites by IP address.
Use Dummy Host Names
for Reverse DNS Lookups
I mentioned previously that it takes a little more work to discover valid host names before a
Web site can be accessed if all you have is an IP address. One way to do this is to perform
a reverse domain name system (DNS) lookup on the IP address. If the IP address resolves
to a host name that is also valid on the Web server, you now have the information you need
to connect to that Web site. However, if the reverse lookup returns something a little more
generic, such as ool-43548c24.companyabc.com, you can keep unwanted attackers from discovering
your Web site via reverse DNS lookups. If you’re using the dummy host name technique,
ensure that the default Web site is also configured to return a blank default Web page.
Again, this is a defense-in-depth mechanism and is not sufficient to prevent unwanted