4.0

31Web Application Penetration TestingResponse from a SunONE 6.1$ nc sunone.example.com 80HEAD / HTTP/1.0HTTP/1.1 200 OKServer: Sun-ONE-Web-Server/6.1Date: Tue, 16 Jan 2007 15:23:37 GMTContent-length: 0Content-type: text/htmlDate: Tue, 16 Jan 2007 15:20:26 GMTLast-Modified: Wed, 10 Jan 2007 09:58:26 GMTConnection: closeWe can notice that the ordering of the Date field and the Server fielddiffers between Apache, Netscape Enterprise, and IIS.Malformed requests testAnother useful test to execute involves sending malformed requestsor requests of nonexistent pages to the server. Consider the followingHTTP responses.Response from Apache 1.3.23$ nc apache.example.com 80GET / HTTP/3.0HTTP/1.1 400 Bad RequestDate: Sun, 15 Jun 2003 17:12: 37 GMTServer: Apache/1.3.23Connection: closeTransfer: chunkedContent-Type: text/HTML; charset=iso-8859-1Response from IIS 5.0$ nc iis.example.com 80GET / HTTP/3.0HTTP/1.1 200 OKServer: Microsoft-IIS/5.0Content-Location: http:/iis.example.com/Default.htmDate: Fri, 01 Jan 1999 20:14: 02 GMTContent-Type: text/HTMLAccept-Ranges: bytesLast-Modified: Fri, 01 Jan 1999 20:14: 02 GMTETag: W/e0d362a4c335be1: ae1Content-Length: 133Response from Netscape Enterprise 4.1HTTP/1.1 505 HTTP Version Not SupportedServer: Netscape-Enterprise/4.1Date: Mon, 16 Jun 2003 06:04: 04 GMTContent-length: 140Content-type: text/HTMLConnection: closeResponse from a SunONE 6.1$ nc sunone.example.com 80GET / HTTP/3.0HTTP/1.1 400 Bad requestServer: Sun-ONE-Web-Server/6.1Date: Tue, 16 Jan 2007 15:25:00 GMTContent-length: 0Content-type: text/htmlConnection: closeWe notice that every server answers in a different way. The answeralso differs in the version of the server. Similar observations can bedone we create requests with a non-existent HTTP method/verb.Consider the following responses:Response from Apache 1.3.23$ nc apache.example.com 80GET / JUNK/1.0HTTP/1.1 200 OKDate: Sun, 15 Jun 2003 17:17: 47 GMTServer: Apache/1.3.23Last-Modified: Thu, 27 Feb 2003 03:48: 19 GMTETag: 32417-c4-3e5d8a83Accept-Ranges: bytesContent-Length: 196Connection: closeContent-Type: text/HTMLResponse from IIS 5.0$ nc iis.example.com 80GET / JUNK/1.0HTTP/1.1 400 Bad RequestServer: Microsoft-IIS/5.0Date: Fri, 01 Jan 1999 20:14: 34 GMTContent-Type: text/HTMLContent-Length: 87$ nc netscape.example.com 80GET / HTTP/3.0