4.0

47
Web Application Penetration Testing
framework-specific folders
• Do not use default scripts on the page or obfuscate them if they
must be used.
Specific files and folders
General guidelines:
• Remove any unnecessary or unused files on the server. This implies
text files disclosing information about versions and installation too.
• Restrict access to other files in order to achieve 404-response when
accessing them from outside. This can be done, for example, by modifying
htaccess file and adding RewriteCond or RewriteRule there. An
example of such restriction for two common WordPress folders is presented
below.
RewriteCond %{REQUEST_URI} /wp-login\.php$ [OR]
RewriteCond %{REQUEST_URI} /wp-admin/$
RewriteRule $ /http:/your_website [R=404,L]
However, these are not the only ways to restrict access. In order to
automate this process, certain framework-specific plugins exist. One
example for WordPress is StealthLogin (http:/wordpress.org/plugins/
stealth-login-page).
Additional approaches
General guidelines:
[1] Checksum management
The purpose of this approach is to beat checksum-based scanners
and not let them disclose files by their hashes. Generally, there are two
approaches in checksum management:
• Change the location of where those files are placed (i.e. move them
to another folder, or rename the existing folder)
• Modify the contents - even slight modification results in a completely
different hash sum, so adding a single byte in the end of the file
should not be a big problem.
[2] Controlled chaos
A funny and effective method that involves adding bogus files and
folders from other frameworks in order to fool scanners and confuse
an attacker. But be careful not to overwrite existing files and folders
and to break the current framework!
Map Application Architecture (OTG-INFO-010)
Summary
The complexity of interconnected and heterogeneous web server infrastructure
can include hundreds of web applications and makes configuration
management and review a fundamental step in testing and
deploying every single application. In fact it takes only a single vulnerability
to undermine the security of the entire infrastructure, and even
small and seemingly unimportant problems may evolve into severe
risks for another application on the same server.
To address these problems, it is of utmost importance to perform an
in-depth review of configuration and known security issues. Before
performing an in-depth review it is necessary to map the network and
application architecture. The different elements that make up the infrastructure
need to be determined to understand how they interact
with a web application and how they affect security.
How to Test
Map the application architecture
The application architecture needs to be mapped through some test
to determine what different components are used to build the web
application. In small setups, such as a simple CGI-based application, a
single server might be used that runs the web server which executes
the C, Perl, or Shell CGIs application, and perhaps also the authentication
mechanism.
On more complex setups, such as an online bank system, multiple
servers might be involved. These may include a reverse proxy, a frontend
web server, an application server and a database server or LDAP
server. Each of these servers will be used for different purposes and
might be even be divided in different networks with firewalls between
them. This creates different DMZs so that access to the web server
will not grant a remote user access to the authentication mechanism
itself, and so that compromises of the different elements of the architecture
can be isolated so that they will not compromise the whole
architecture.
Getting knowledge of the application architecture can be easy if this
information is provided to the testing team by the application developers
in document form or through interviews, but can also prove to
be very difficult if doing a blind penetration test.
In the latter case, a tester will first start with the assumption that
there is a simple setup (a single server). Then they will retrieve information
from other tests and derive the different elements, question
this assumption and extend the architecture map. The tester will start
by asking simple questions such as: “Is there a firewalling system protecting
the web server?”. This question will be answered based on the
results of network scans targeted at the web server and the analysis
of whether the network ports of the web server are being filtered
in the network edge (no answer or ICMP unreachables are received)
or if the server is directly connected to the Internet (i.e. returns RST
packets for all non-listening ports). This analysis can be enhanced to
determine the type of firewall used based on network packet tests.
Is it a stateful firewall or is it an access list filter on a router? How is it
configured? Can it be bypassed?
Detecting a reverse proxy in front of the web server needs to be done
by the analysis of the web server banner, which might directly disclose
the existence of a reverse proxy (for example, if ‘WebSEAL’[1] is returned).
It can also be determined by obtaining the answers given by
the web server to requests and comparing them to the expected answers.
For example, some reverse proxies act as “intrusion prevention
systems” (or web-shields) by blocking known attacks targeted at the
web server. If the web server is known to answer with a 404 message
to a request that targets an unavailable page and returns a different
error message for some common web attacks like those done by CGI
scanners, it might be an indication of a reverse proxy (or an application-level
firewall) which is filtering the requests and returning a different
error page than the one expected. Another example: if the web
server returns a set of available HTTP methods (including TRACE) but
the expected methods return errors then there is probably something
in between blocking them.
In some cases, even the protection system gives itself away:
GET /web-console/ServerInfo.jsp%00 HTTP/1.0
HTTP/1.0 200
Pragma: no-cache