4.0

48Web Application Penetration TestingCache-Control: no-cacheContent-Type: text/htmlContent-Length: 83ErrorErrorFW-1 at XXXXXX: Access denied.Example of the security server of Check Point Firewall-1 NG AI “protecting”a web serverReverse proxies can also be introduced as proxy-caches to acceleratethe performance of back-end application servers. Detecting theseproxies can be done based on the server header. They can also bedetected by timing requests that should be cached by the server andcomparing the time taken to server the first request with subsequentrequests.Another element that can be detected is network load balancers.Typically, these systems will balance a given TCP/IP port to multipleservers based on different algorithms (round-robin, web server load,number of requests, etc.). Thus, the detection of this architecture elementneeds to be done by examining multiple requests and comparingresults to determine if the requests are going to the same or differentweb servers. For example, based on the Date header if the serverclocks are not synchronized. In some cases, the network load balanceprocess might inject new information in the headers that will make itstand out distinctively, like the AlteonP cookie introduced by Nortel’sAlteon WebSystems load balancer.Application web servers are usually easy to detect. The request forseveral resources is handled by the application server itself (not theweb server) and the response header will vary significantly (includingdifferent or additional values in the answer header). Another way todetect these is to see if the web server tries to set cookies which areindicative of an application web server being used (such as the JSES-SIONID provided by some J2EE servers), or to rewrite URLs automaticallyto do session tracking.Authentication back ends (such as LDAP directories, relational databases,or RADIUS servers) however, are not as easy to detect from anexternal point of view in an immediate way, since they will be hiddenby the application itself.The use of a back end database can be determined simply by navigatingan application. If there is highly dynamic content generated “on thefly,” it is probably being extracted from some sort of database by theapplication itself. Sometimes the way information is requested mightgive insight to the existence of a database back-end. For example, anonline shopping application that uses numeric identifiers (‘id’) whenbrowsing the different articles in the shop. However, when doing ablind application test, knowledge of the underlying database is usuallyonly available when a vulnerability surfaces in the application, such aspoor exception handling or susceptibility to SQL injection.References[1] WebSEAL, also known as Tivoli Authentication Manager, is a reverseproxy from IBM which is part of the Tivoli framework.[2] There are some GUI-based administration tools for Apache (likeNetLoony) but they are not in widespread use yet.Testing for configuration managementUnderstanding the deployed configuration of the server hosting theweb application is almost as important as the application securitytesting itself. After all, an application chain is only as strong as itsweakest link. Application platforms are wide and varied, but some keyplatform configuration errors can compromise the application in thesame way an unsecured application can compromise the server.Test Network/Infrastructure Configuration(OTG-CONFIG-001)SummaryThe intrinsic complexity of interconnected and heterogeneous webserver infrastructure, which can include hundreds of web applications,makes configuration management and review a fundamental step intesting and deploying every single application. It takes only a singlevulnerability to undermine the security of the entire infrastructure,and even small and seemingly unimportant problems may evolve intosevere risks for another application on the same server. In order toaddress these problems, it is of utmost importance to perform an indepthreview of configuration and known security issues, after havingmapped the entire architecture.Proper configuration management of the web server infrastructure isvery important in order to preserve the security of the application itself.If elements such as the web server software, the back-end databaseservers, or the authentication servers are not properly reviewedand secured, they might introduce undesired risks or introduce newvulnerabilities that might compromise the application itself.For example, a web server vulnerability that would allow a remoteattacker to disclose the source code of the application itself (a vulnerabilitythat has arisen a number of times in both web servers orapplication servers) could compromise the application, as anonymoususers could use the information disclosed in the source code to leverageattacks against the application or its users.The following steps need to be taken to test the configuration managementinfrastructure:• The different elements that make up the infrastructure need tobe determined in order to understand how they interact with a webapplication and how they affect its security.• All the elements of the infrastructure need to be reviewed in order tomake sure that they don’t contain any known vulnerabilities.• A review needs to be made of the administrative tools used tomaintain all the different elements.• The authentication systems, need to reviewed in order to assurethat they serve the needs of the application and that they cannot bemanipulated by external users to leverage access.• A list of defined ports which are required for the application shouldbe maintained and kept under change control.After having mapped the different elements that make up the infrastructure(see Map Network and Application Architecture) it is possibleto review the configuration of each element founded and test for anyknown vulnerabilities.How to TestKnown Server VulnerabilitiesVulnerabilities found in the different areas of the application architecture,be it in the web server or in the back end database, can severe-