4.0

154
Web Application Penetration Testing
• Amit Klein: “HTTP Response Smuggling” -
http://www.securityfocus.com/archive/1/425593
• Chaim Linhart, Amit Klein, Ronen Heled, Steve Orrin: “HTTP
Request Smuggling” - http://www.cgisecurity.com/lib/httprequest-smuggling.pdf
Testing for Error Code (OTG-ERR-001)
Summary
Often, during a penetration test on web applications, we come
up against many error codes generated from applications or
web servers. It’s possible to cause these errors to be displayed
by using a particular requests, either specially crafted with tools
or created manually. These codes are very useful to penetration
testers during their activities, because they reveal a lot of information
about databases, bugs, and other technological components
directly linked with web applications.
This section analyses the more common codes (error messages)
and bring into focus their relevance during a vulnerability assessment.
The most important aspect for this activity is to focus
one’s attention on these errors, seeing them as a collection of
information that will aid in the next steps of our analysis. A good
collection can facilitate assessment efficiency by decreasing the
overall time taken to perform the penetration test.
Attackers sometimes use search engines to locate errors that
disclose information. Searches can be performed to find any erroneous
sites as random victims, or it is possible to search for
errors in a specific site using the search engine filtering tools as
described in 4.2.1 Conduct Search Engine Discovery and Reconnaissance
for Information Leakage (OTG-INFO-001)
Web Server Errors
A common error that we can see during testing is the HTTP 404
Not Found. Often this error code provides useful details about
the underlying web server and associated components. For example:
Not Found
The requested URL /page.html was not found on this server.
Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.7g DAV/2
PHP/5.1.2 Server at localhost Port 80
This error message can be generated by requesting a non-existent
URL. After the common message that shows a page not
found, there is information about web server version, OS, modules
and other products used. This information can be very important
from an OS and application type and version identification
point of view.
Other HTTP response codes such as 400 Bad Request, 405
Method Not Allowed, 501 Method Not Implemented, 408 Request
Time-out and 505 HTTP Version Not Supported can be
forced by an attacker. When receiving specially crafted requests,
web servers may provide one of these error codes depending on
their HTTP implementation.
Testing for disclosed information in the Web Server error codes
is related testing for information disclosed in the HTTP headers
as described in the section Fingerprint Web Server (OTG-IN-
FO-002).
Application Server Errors
Application errors are returned by the application itself, rather
than the web server. These could be error messages from framework
code (ASP, JSP etc.) or they could be specific errors returned
by the application code. Detailed application errors typically provide
information of server paths, installed libraries and application
versions.
Database Errors
Database errors are those returned by the Database System
when there is a problem with the query or the connection. Each
Database system, such as MySQL, Oracle or MSSQL, has their
own set of errors. Those errors can provide sensible information
such as Database server IPs, tables, columns and login details.
In addition, there are many SQL Injection exploitation techniques
that utilize detailed error messages from the database driver, for
in depth information on this issue see Testing for SQL Injection
(OTG-INPVAL-005) for more information.
Web server errors aren’t the only useful output returned requiring
security analysis. Consider the next example error message:
Microsoft OLE DB Provider for ODBC Drivers (0x80004005)
[DBNETLIB][ConnectionOpen(Connect())] - SQL server does not
exist or access denied
What happened? We will explain step-by-step below.
In this example, the 80004005 is a generic IIS error code which
indicates that it could not establish a connection to its associated
database. In many cases, the error message will detail the type
of the database. This will often indicate the underlying operating
system by association. With this information, the penetration
tester can plan an appropriate strategy for the security test.
By manipulating the variables that are passed to the database
connect string, we can invoke more detailed errors.
Microsoft OLE DB Provider for ODBC Drivers error ‘80004005’
[Microsoft][ODBC Access 97 ODBC driver Driver]General error
Unable to open registry key ‘DriverId’
In this example, we can see a generic error in the same situation
which reveals the type and version of the associated database
system and a dependence on Windows operating system registry
key values.
Now we will look at a practical example with a security test
against a web application that loses its link to its database server
and does not handle the exception in a controlled manner. This
could be caused by a database name resolution issue, processing
of unexpected variable values, or other network problems.
Consider the scenario where we have a database administration
web portal, which can be used as a front end GUI to issue database