the-web-application-hackers-handbook

672 Chapter 18 n Attacking the Application Server
Figure 18-1 shows the default page phpinfo.php, which exists on many Apache
installations. This page simply executes the PHP function phpinfo() and returns
the output. It contains a wealth of information about the PHP environment,
configuration settings, web server modules, and file paths.
Figure 18-1: The default page phpinfo.php
Sample Functionality
By default many servers include various sample scripts and pages designed to
demonstrate how certain application server functions and APIs can be used.
Typically, these are intended to be innocuous and to provide no opportunities
for an attacker. However, in practice this has not been the case, for two reasons:
n Many sample scripts contain security vulnerabilities that can be exploited
to perform actions not intended by the scripts’ authors.
n Many sample scripts actually implement functionality that is of direct
use to an attacker.
An example of the first problem is the Dump Servlet included in Jetty version
7.0.0. This servlet can be accessed from a URL such as /test/jsp/dump
.jsp. When it is accessed, it prints various details of the Jetty installation and
the current request, including the request query string. This allows for simple