Web Server Hacking Methodology

Web Server Pen Testing

Identify the target

• Search open sources for info about the target

= internet, newsgroups, bulletin boards etc

• Perform social engineering

=social networking, dumpster driving

• Query the whois databases

=Whois, traceroute, active whois, etc

• Document all info about target

Web Server Pen Testing continued:

• fingerprint web server 

=use tools such as netcraft and httprecon

• Crawl website

=Use tools such as HTTtrackm webcopier pro

• Enumerate web directories

=use tools such as Nmap

• Perform directory traversal attack

=use automated tools such as Dirbuster

• Examine config files

• Perform vuln assessment

=identify weaknesses in a network, tools: Acunetix, web inspect, nessus

• Perform HTTP response splitting

=to pass malicious data to a vuln app that includes the data in an http resonse header

• Web cache poisoning attack

= to force the web servers cahce to flush its actual cache conent ad senda specially crafted request, which will be stored in cache

• Crack web server authentication
• Bruteforce SSH,FTP, and other services

= to gain unauthorized access

• Perform session hijacking

= to capture valid session cookies and IDs, Use tools such as Burp Suite, Firesheep, JHiJack, to automate session hijacking

• Perform MITM attack 

=to access sensitive info by intercepting and altering comms between an end-user and web servers

Perform web app pen testing:

• Examine web server log

=Use tools such as webalizer AWstats, Ktmatu relax, to examine web server logs

• Exploit frameworks

=Use tools such as metasploit, w3af to exploit frameworks

• Document all findings

Web server pen testing steps in full:

• Identify the target
• Search open sources for info about the target
• Perform social enginerring
• Query the Whois dbs
• Document all info about target
• Fingerprint web server
• Crawl website
• Enumerate web directories
• Perform directory traversal attack
• Examine config files
• Perform vuln assesment
• Perform HTTP response splitting
• Web cache poisoning attack
• Crack web server authentication
• Bruteforce SSH, FTP, and other services
• Perform session hijacking
• Perform MITM attack
• Perform web app pen testing
• Examine web server logs
• Exploit frameworks