From: Caleb Sima (csima@spidynamics.com)
Date: Tue Sep 17 2002 - 13:42:52 EDT
Steven,
A couple of basic things on a black perspective that you should look for
are below. You can also download webinspect from www.spidynamics.com
and have it check for all of these things for you.
1 - requests for diffrent directories on the webserver such as
/admin/
/adm/
/test/
/logs/ etc..
also match these requests with the type of business the app is
running , for instance if it's a bank and the name is 'freebank' then
look for directories such as /freebank/,/banking/,/finance/ etc. this
might get you access to directory listings that could show valuable
files
2 - check for common files in each of the directories , look for core
files or ws_ftp.log,test.html files, these can give great info on the
system
3 - look for any pages with user input on the site and check for
directory traversal attacks such as /../etc/passwd, or command execution
|/bin/ls etc.. feed the website with odd input like *,!,` etc, look for
any detailed error msgs that might lead you further
4 - Crawl the site and search the text for any comments '<!--' see if
any valuable info is located in them, also look for hidden tags
'type=hidden' to see if file locations or prices are stored there
5 - Identify the way cookies are setup, if they have cookies are thier
id numbers sequential or easily munged with base64 or XOR, if they are
then try to identify a protected page and send requests with other id
numbers to see if access is given
6 - Check for old/backup files that might have been created, if thier is
a login.php page look for login.php.bak,login.old etc.. these can return
source code
7 - In all input fields check for sql injection, input single quotes
into the fields and look for database errors
8 - Check for all the known issues, do a search on neohapsis for
netscape or apache,
netscape : host.com/?wp-ver-info
host.com/?properties
host.com/admin-serv/config/adm.conf
host.com/search?
etc..
Apache:
check for openssl overflow issue
chunked encoding
host.com/server-info
host.com/server-status
etc..
On Mon, 2002-09-16 at 13:05, Steven Walker wrote:
> Dear Group,
>
> I have been given a project to perform web application vulnerability testing
> on iPlanet and Apache web servers. The servers run on NT/2000, Solaris
> 2.7-8, (iPlanet) and Linux, Solaris (Apache).
>
> In house tools are Wisker, WHArenal, NMAP, NESSUS. I have only used NMAP
> and NESSUS so far for firewall and internal network testing.
>
> I am at a loss at where to start the process and am trying to determine if
> additional tools are needed.
>
> 1. I would obviously harden the web server OS's by closing unnecessary
> ports, ensuring proper patch levels, getting rid of rhost and equiv files,
> enforcing password policies, limiting accounts, use ssh for administration,
> etc.
>
> 2. I don't know what to do on the web servers other than delete example
> scripts and ensure default passwords are changed to stronger ones. Are
> there any links that you know of that would provide a checklist of iPlanet
> and Apache vulnerability checks. Are there any recommended tools that can
> automate this process? Any suggestions on iPlanet and Apache security?
>
> 3. Regarding web applications, I will be expected to test applications
> before they go into production. I know to test for buffer overflows buy
> inputting non expected characters into fields. Beyond that what advice
> could you give or methodology could you direct me too. Jobs are tough to
> find out there, I could use your help in keeping this one. Thanks for all
> of you who will help me.
>
> Sincerely
>
> Steven M. Walker CISSP, GSEC, ABCP
> Security Specialist
> 44 W. Douglas Dr.
> Saint Peters, MO 63376
> Office: 636.279.2206
> Home: 636.278.8004
>
>
>
>
> ----------------------------------------------------------------------------
> This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
> Service. For more information on SecurityFocus' SIA service which
> automatically alerts you to the latest security vulnerabilities please see:
> https://alerts.securityfocus.com/
>
----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:25 EDT