the-web-application-hackers-handbook

CHAPTER
18
Attacking the
Application Server
As with any kind of application, a web application depends on the other layers
of the technology stack that support it, including the application or web server,
operating system, and networking infrastructure. An attacker may target any
of these components. Compromising the technology on which an application
depends very often enables an attacker to fully compromise the application itself.
Most attacks in this category are outside the scope of a book about attacking web
applications. One exception to this is attacks that target the application and web
server layers, as well as any relevant application-layer defenses. Inline defenses
are commonly employed to help secure web applications and identify attacks.
Circumventing these defenses is a key step in compromising the application.
So far we have not drawn a distinction between a web server and an application
server, because the attacks have targeted application functionality, irrespective
of how it is provided. In reality, much of the presentation layer, communication
with back-end components, and the core security framework may be managed
by the application container. This may give additional scope to an attack. Clearly
any vulnerability in the technologies that deliver this framework will be of interest
to an attacker if they can be used to directly compromise the application.
This chapter focuses on ways of leveraging defects at the application server
layer from an Internet perspective to attack the web application running on it.
The vulnerabilities that you can exploit to attack application servers fall into two
broad categories: shortcomings in the server’s configuration, and security flaws
within application server software. A list of defects cannot be comprehensive,
669