4.0

53Web Application Penetration TestingStandards, using standard file extensions provides the penetrationtester useful information about the underlying technologies used ina web appliance and greatly simplifies the task of determining theattack scenario to be used on particular technologies. In addition,mis-configuration of web servers could easily reveal confidential informationabout access credentials.Extension checking is often used to validate files to be uploaded,which can lead to unexpected results because the content is not whatis expected, or because of unexpected OS file name handling.Determining how web servers handle requests corresponding to fileshaving different extensions may help in understanding web server behaviordepending on the kind of files that are accessed. For example,it can help to understand which file extensions are returned as text orplain versus those that cause execution on the server side. The latterare indicative of technologies, languages or plugins that are used byweb servers or application servers, and may provide additional insighton how the web application is engineered. For example, a “.pl” extensionis usually associated with server-side Perl support. However, thefile extension alone may be deceptive and not fully conclusive. For example,Perl server-side resources might be renamed to conceal thefact that they are indeed Perl related. See the next section on “webserver components” for more on identifying server side technologiesand components.How to TestForced browsingSubmit http[s] requests involving different file extensions and verifyhow they are handled. The verification should be on a per web directorybasis. Verify directories that allow script execution. Web serverdirectories can be identified by vulnerability scanners, which look forthe presence of well-known directories. In addition, mirroring the website structure allows the tester to reconstruct the tree of web directoriesserved by the application.If the web application architecture is load-balanced, it is important toassess all of the web servers. This may or may not be easy, dependingon the configuration of the balancing infrastructure. In an infrastructurewith redundant components there may be slight variationsin the configuration of individual web or application servers. This mayhappen if the web architecture employs heterogeneous technologies(think of a set of IIS and Apache web servers in a load-balancing configuration,which may introduce slight asymmetric behavior betweenthem, and possibly different vulnerabilities).‘Example:The tester has identified the existence of a file named connection.inc.Trying to access it directly gives back its contents, which are:mysql_connect(“127.0.0.1”, “root”, “”)or die(“Could not connect”);The tester determines the existence of a MySQL DBMS back end, andthe (weak) credentials used by the web application to access it.The following file extensions should never be returned by a web server,since they are related to files which may contain sensitive informationor to files for which there is no reason to be served.• .asa• .incThe following file extensions are related to files which, when accessed,are either displayed or downloaded by the browser. Therefore, fileswith these extensions must be checked to verify that they are indeedsupposed to be served (and are not leftovers), and that they do notcontain sensitive information.• .zip, .tar, .gz, .tgz, .rar, ...: (Compressed) archive files• .java: No reason to provide access to Java source files• .txt: Text files• .pdf: PDF documents• .doc, .rtf, .xls, .ppt, ...: Office documents• .bak, .old and other extensions indicative of backup files (for example:~ for Emacs backup files)The list given above details only a few examples, since file extensionsare too many to be comprehensively treated here. Refer to http:/filext.com/ for a more thorough database of extensions.To identify files having a given extensions a mix of techniques can beemployed. THese techniques can include Vulnerability Scanners, spideringand mirroring tools, manually inspecting the application (thisovercomes limitations in automatic spidering), querying search engines(see Testing: Spidering and googling). See also Testing for Old,Backup and Unreferenced Files which deals with the security issuesrelated to “forgotten” files.File UploadWindows 8.3 legacy file handling can sometimes be used to defeat fileupload filtersUsage Examples:file.phtml gets processed as PHP codeFILE~1.PHT is served, but not processed by the PHP ISAPI handlershell.phPWND can be uploadedSHELL~1.PHP will be expanded and returned by the OS shell,then processed by the PHP ISAPI handlerGray Box testingPerforming white box testing against file extensions handlingamounts to checking the configurations of web servers or applicationservers taking part in the web application architecture, and verifyinghow they are instructed to serve different file extensions.If the web application relies on a load-balanced, heterogeneous infrastructure,determine whether this may introduce different behavior.ToolsVulnerability scanners, such as Nessus and Nikto check for the ex-