the-web-application-hackers-handbook

846 Chapter 21 n A Web Application Hacker’s Methodology
10.2.2 If a common database is used within any kind of shared environment,
perform a comprehensive audit of the database configuration, patch level,
table structure, and permissions using a database scanning tool such as
NGSSquirrel. Any defects within the database security model may provide
a way to escalate an attack from within one application to another.
11 Test for Application Server Vulnerabilities
11.1. Test for default credentials
11.2. Test for default content
11.3. Test for dangerous HTTP methods
11.4. Test for proxy functionality
11.5. Test for virtual hosting misconfiguration
11.6. Test for web server software bugs
11.7. Test for web application firewalling
Figure 21-12: Testing for web server vulnerabilities
11.1 Test for Default Credentials
11.1.1 Review the results of your application mapping exercises to identify the
web server and other technologies in use that may contain accessible
administrative interfaces.
11.1.2 Perform a port scan of the web server to identify any administrative
interfaces running on a different port than the main target application.
11.1.3 For any identified interfaces, consult the manufacturer’s documentation
and common default password listings to obtain default credentials.
11.1.4 If the default credentials do not work, use the steps listed in section 4
to attempt to guess valid credentials.
11.1.5 If you gain access to an administrative interface, review the available
functionality and determine whether it can be used to further compromise
the host and attack the main application.