Web Application Hacking · Topic 1 of 8
Web Servers: Attacks, Methodology and Patch Management
Web server architecture, common web server attacks, the attack methodology, hardening countermeasures, and the patch management process and terms CEH tests.
- 4 min
- Methodology: information gathering, footprinting, mirroring, vulnerability scanning, session hijacking, password cracking.
- Directory traversal, response splitting, cache poisoning and defacement are named web server attacks.
- Hardening: remove defaults, least privilege, patch, secure headers and a WAF.
What it is
A web server accepts HTTP and HTTPS requests and returns pages or data. Common servers are Apache HTTP Server, Microsoft IIS and Nginx. Because they are exposed to the internet, they are a prime target.
This page covers how web servers are attacked, how attackers work through a standard methodology, how to harden a server, and how patch management closes known holes.
How it works
Concepts
A web server stack has the operating system, the server software, the application runtime and the content. Weakness at any layer can be abused. Typical causes of compromise are default installs, unnecessary services, weak or default accounts, misconfigured permissions, verbose errors and missing patches.
Attacks
| Attack | Idea |
|---|---|
| Denial of service | Exhausting the server, covered with DoS and DDoS |
| Directory traversal | Using sequences such as ../ in a path so the server serves files outside the web root |
| HTTP response splitting | Injecting line breaks into headers so the response is split and attacker content is added |
| Web cache poisoning | Getting a harmful response stored in a cache and served to others |
| Website defacement | Altering page content after a compromise |
| Misconfiguration abuse | Directory listing, default pages, exposed admin consoles and sample files |
| Password attacks | Guessing or cracking administrator and service logins |
| SSH or FTP brute force | Guessing remote management credentials |
| Server side request forgery (SSRF) | Making the server request internal resources for the attacker |
| DNS server hijacking and phishing | Redirecting users to fake copies of the site |
| Web server hijacking | Taking control through a vulnerability, then using it to attack others |
Directory traversal is blocked by validating and canonicalizing paths, running the server with low privilege and keeping the web root isolated.
Attack methodology
| Stage | Purpose | Examples |
|---|---|---|
| Information gathering | Learn about the target from public sources | Search engines, Whois, DNS records, Netcraft |
| Web server footprinting | Identify server type, version and technology | Banner grabbing, Nmap, httprecon, ID Serve |
| Website mirroring | Copy the site to study structure offline | HTTrack |
| Vulnerability scanning | Find known flaws and misconfigurations | Nikto, Nessus, Acunetix |
| Session hijacking | Take over authenticated sessions | Burp Suite, proxies |
| Password cracking | Obtain administrator access | Hydra, Medusa |
Nikto checks a web server for dangerous files, outdated versions and misconfigurations. Nmap NSE scripts such as http-enum and http-title help discover content and page titles.
Countermeasures
- Remove default accounts, sample pages and unneeded modules, and disable directory listing.
- Run the server as a low privilege account and keep content on a separate partition from the operating system.
- Use HTTPS with current TLS, set secure headers, and hide version banners and detailed errors.
- Restrict administrative interfaces to trusted networks and require multi factor authentication.
- Use a web application firewall, file integrity monitoring and central logging.
- Scan regularly and patch quickly.
Patch management
A patch fixes a flaw. A hotfix is a quick patch for a specific problem, often issued outside the usual cycle. A service pack or cumulative update is a bundle of fixes. Patch management is the managed process of keeping software current.
| Step | Activity |
|---|---|
| Detect | Inventory systems and learn about new patches |
| Assess | Rate risk and decide priority |
| Acquire | Download from a trusted source and check the signature or hash |
| Test | Try the patch in a non production environment |
| Deploy | Roll out in a schedule with a rollback plan |
| Maintain | Verify, document and re-scan |
Microsoft WSUS and Configuration Manager, and commercial tools such as Ivanti and ManageEngine Patch Manager Plus, automate parts of this. A vulnerability scanner confirms that patching worked.
A worked example
A scan finds a server with directory listing enabled and an old module with a known flaw. The fix is to disable listing, remove or update the module through the patch process (test, then deploy), and re-scan to confirm.
How the exam asks about this
- "Which attack uses
../sequences to read files outside the web root?" -> Directory traversal. - "Which tool scans a web server for dangerous files and outdated versions?" -> Nikto.
- "In patch management, what comes right before deployment?" -> Testing the patch in a non production environment.
What to remember for the exam
- Methodology: information gathering, footprinting, mirroring, vulnerability scanning, session hijacking, password cracking.
- Directory traversal, response splitting, cache poisoning and defacement are named web server attacks.
- Hardening: remove defaults, least privilege, patch, secure headers and a WAF.
- A hotfix is a targeted patch. A service pack bundles many fixes.
- Verify patches with a hash or signature, and test before deploying.
Hiding the version banner helps, but it is not a substitute for patching. Obscurity alone does not remove a vulnerability.
Common mistakes
Treating a scan result as proof. Scanners report possible issues that need verification.
Patching without testing. An untested patch can break the application.
Leaving defaults in place. Sample files and default accounts are common entry points.
Check yourself
What does HTTrack do?
It mirrors a website for offline study of its structure.
Why run a web server as a low privilege account?
A compromise then gives the attacker limited rights on the operating system.
What is the purpose of a rollback plan in patching?
It lets you restore service if the patch causes problems.
Topic 1 of 8 in Web Application Hacking
Test yourself on Web Application Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.