the-web-application-hackers-handbook

670 Chapter 18 n Attacking the Application Server
because software of this type is liable to change over time. But the flaws described
here illustrate the typical pitfalls awaiting any application implementing its own
native extensions, modules, or APIs, or reaching outside the application container.
This chapter also examines web application firewalls, describes their strengths
and weaknesses, and details ways in which they can often be circumvented to
deliver attacks.
Vulnerable Server Configuration
Even the simplest of web servers comes with a wealth of configuration options
that control its behavior. Historically, many servers have shipped with insecure
default options, which present opportunities for attack unless they are explicitly
hardened.
Default Credentials
Many web servers contain administrative interfaces that may be publicly accessible.
These may be located at a specific location within the web root or may run
on a different port, such as 8080 or 8443. Frequently, administrative interfaces
have default credentials that are well known and are not required to be changed
on installation.
Table 18-1 shows examples of default credentials on some of the most commonly
encountered administrative interfaces.
Table 18-1: Default Credentials on Some Common Administrative Interfaces
USERNAME
PASSWORD
admin
(none)
Apache Tomcat
tomcat
tomcat
root
root
Sun JavaServer admin admin
Netscape Enterprise Server admin admin
administrator
administrator
anonymous
(none)
Compaq Insight Manager
user
user
operator
operator
user
public
Zeus admin (none)