Web Server Attacks | Penetration Testing

Set — 2

Hackers can make different sorts of harm, exploits an association by hacking web servers. A hacker can utilize numerous procedures to exploit or harm a web server, for example, DoS/DDoS, DNS server amplification, XSS, sniffing, phishing, web server misconfiguration, HTTP reaction parting, web reserve harming, SSH brute force, web server secret key breaking, etc.

Types of Web Server Attacks:

• DoS/DDoS Attacks: A DoS/DDoS attack involves flooding targets with numerous fake requests so that the target stops functioning and will be unbelievable to legitimate users. Using a web server DoS/DDoS attack, an attacker attempts to take the webserver down or make it unbelievable to the legitimate users. A DoS/DDoS exploit regularly targets prominent web servers, for example, banks, Mastercard installment passages, and even root name servers. To halt the webserver running the application, the hacker focuses on the accompanying administrations by burning-through the webserver with counterfeit queries.
• Network Bandwidth
• CPU Usage
• Server Memory
• Application exception handling mechanism
• Hard Disk space
• Database space
• DNS Server Hijacking: Domain Name System resolves a domain name to its corresponding IP address. A user queries the DNS server with a domain name and delivers the corresponding IP address. In a DNS server hijacking, a hacker compromises the DNS and changes the mapping settings of the target DNS server to redirect toward a rogue DNS server so that it would redirect the user’s requests to the attacker’s rogue server. In this way, when the client types the authentic URL in a web browser, the settings will divert to the aggressor’s phony site.
• DNS Amplification Attack: DNS amplification is a Distributed Denial of Service (DDoS) assault in which the assailant abuses weaknesses in the domain name framework to transform at first little inquiries into a lot bigger payloads, which are accustomed to cut down the target’s mainframes. DNS amplification, as other amplification assaults, is a sort of reflection hack. For this situation, the reflection is accomplished by inspiring a reaction from a DNS resolver to a mock IP address. During a DNS amplification assault, the culprit conveys a DNS inquiry with a forged IP address (the victim’s) to an open DNS resolver, inciting it to answer back to that address with a DNS reaction.
• Directory Traversal Attacks: A hacker might have the option to play out this type of exploit because of weakness present in the code on the web application. Also, inadequately fixed or arranged web server programming can make the web server itself helpless against this attack. The plan of web servers limits the community somewhat. this attack is the abuse of HTTP through which hackers can get to confined registries and execute orders outside of the web-server’s root registry by controlling URL. The hacker normally plays out this exploit with the assistance of a web browser. A web server is powerless against this assault if it acknowledges input information from a program without legitimate approval.
• Sniffing Attacks: MITM exploits permit a hacker to get to delicate data by capturing and changing interchanges between an end-client and web servers. In this kind of endeavor, an interloper blocks or changes the messages traded between the client and web server through snooping or encroaching into an association. This permits an assailant to take passwords, etc, moved over the Internet to the web-server. The hacker draws the casualty to interface with the web-server by professing to be an intermediary. In the event that the casualty accepts and consents to the hacker’s queries, at that point all the correspondence between the client and the web-server goes through the aggressor. Along these lines, the hacker can take delicate client data.
• Phishing Attacks: Hackers play out phishing exploit by sending an email containing a noxious connection and deceiving the client to click it. Tapping the connection will divert the client to counterfeit a site that seems to be like the real site. The aggressors make such a site utilizing their location facilitated on web servers. At the point when a casualty tap on the malignant connection accepting the connection is a real site address, it sidetracks to the pernicious site facilitated on the hacker’s server. The site prompts the client to enter delicate data, for example, a username, passwords, money related record data, federal retirement aide numbers, etc and uncovers the information to the assailant. Afterward, the aggressor may set up a meeting with the authentic site with the casualty’s taken accreditation so as to play out a vindictive procedure on the objective genuine site.
• Website Defacement: It alludes to the unapproved changes made to the content of a single page or a whole site, bringing about changes to the visual appearance of the site or a website page. Hackers break into web servers and adjust the facilitated site by infusing code so as to include pictures, popups, or text to a page so that the visual appearance of the page changes. Sometimes, the hacker may supplant the whole site rather than simply changing single pages. Ruined pages open guests to some promulgation or deceiving data until the unapproved changes are found and amended. Hackers utilize an assortment of techniques, for example, MySQL infusion to get to a site so as to mutilate it.
• HTTP Response -Splitting Attack: This an exploit wherein the hacker deceives the server by infusing new lines into reaction headers, alongside subjective code. It includes including header reaction information into the info field so the server parts the reaction into two reactions. This kind of assault misuses weaknesses in input approval. Cross-Site Scripting, Cross-Site Request Forgery, and SQL Injection are a portion of the instances of this kind of assault. In this assault, the aggressor controls the info boundary and cunningly builds a solicitation header that causes two reactions from the server. The hacker changes a solitary query to show up as two solicitations header reaction information into the info field.
• Web Cache Poisoning Attack: It exploits the dependability of a moderate web reserve source. In the assault, the aggressor’s trade reserved cache content for an irregular URL with tainted content or data. Clients of the web cache source can accidentally utilize the harmed content rather than valid and made sure about substance while mentioning the necessary URL through the web reserve. A hacker powers the web to cut off cache to flush its genuine reserve content and sends an uncommonly made solicitation to store in the store. For this situation, all the clients of that web server reserve will get malevolent substance until the servers flush the web cache. Web cache harming attacks are conceivable if the web-server and application have HTTP Response-Splitting blemishes.
• SSH Brute Force Attack: Hackers utilize the SSH conventions to make an encrypted/scrambled SSH tunnel between two hosts so as to move decoded information over an unreliable organization. For the most part, SSH runs TCP port 22. So as to direct an exploit on SSH, the aggressor filters the whole SSH server utilizing bots to recognize potential weaknesses. With the assistance of an animal power assault, the aggressor gains the login qualifications to get unapproved admittance to an SSH burrow. A hacker who gains the login accreditation of SSH can utilize a similar SSH passage to send malware and different methods for misuse to casualties without being distinguished. Hackers use apparatuses, for example, Nmap and ncrack on a Linux stage to play out an SSH brute force attack.
• Web Server Password Cracking: A hacker attempts to abuse shortcomings to hack all-around picked passwords. The most widely recognized passwords discovered are the secret phrase, root, overseer, administrator, demo, test, visitor, qwerty, pet names, etc. Hackers target essentially the SMTP and FTP servers, Web shares, SSH burrows, Webform verification breaking. Aggressors utilize various techniques, for example, social designing, caricaturing, phishing, utilizing a Trojan horse or infection, wiretapping, keystroke logging, etc. Many hacking endeavors start with breaking passwords and demonstrate to the web server that they are a substantial client. Breaking a secret key is the most well-known technique for increasing unapproved admittance to the web-server by abusing its defective and frail verification system. When the secret word is broken, an aggressor can utilize those passwords to dispatch further assaults.

Even if the web-servers are configured securely or are secured using network security measures such as firewalls, a poorly coded web application developed on the web server may give a path to an attacker to compromise the web server’s security. If the web developers do not adopt secure coding practices while developing web applications, it may give attackers the chance to exploit vulnerabilities and compromise web applications and web server security. A hacker can perform various kinds of assaults on weak web applications to break the mainframe’s security.

• Parameter/Form Tampering: In this sort of a hack, the hacker controls the parameters traded among customer and mainframe so as to change application data, such as client credentials and authorizations, cost and amount of items, etc.
• Cookie Tampering: These kinds of assaults happen when sending a cookie from the customer side to the mainframe. Various kinds of instruments help in changing persevering and non-constant cookies.
• Invalidated Input and File Injection Attacks: Invalidated information and document injection assaults are performed by providing an invalidated input or by infusing records into a web application.
• SQL Injection Attacks: This exploits the security vulnerability of a database for attacks. The hacker implements this attack as it injects malicious code into the strings and later passes it on to the SQL Server for execution process.
• Session Hijacking: It is a type of hack where the hacker misuses, takes, predicts, and arranges the genuine substantial web session’s control system to get to the verified pieces of a web application.
• Directory Traversal: It is the misuse of HTTP through which assailants can get to limited registries and execute orders outside of the web mainframe’s root registry by controlling a URL.
• Denial-of-Service Attack: A Dos attack is initiated to terminate the operations of a website or a server and make it unavailable for access by intended users.
• Cross-Site Scripting: In this hack, an attacker injects HTML tags or scripts into a target website.
• Buffer Overflow: The plan of most web applications encourages them in supporting some measure of information. On the off chance that the storage space surpasses the extra room accessible, the application may crash or may display some other weak conduct. The hacker utilizes this favorable position and floods the application with an excessive amount of information, which thusly causes this hack.
• Cross-Site Request Forgery Attack: A hacker exploits the trust of an authenticated user to pass malicious code or commands to the web-server.
• Command Injection Attack: In this, a hacker alters the content of the web page by using HTML code and identifying the form fields that lack valid constraints.
• Source Code Disclosure: This hack is a consequence of typographical mistakes in contents or due to misconfiguration, for example, neglecting to concede executable consents to content or catalog. This exposure can once in a while permitting the aggressors to increase delicate data about information base qualifications and mystery keys and bargain the web mainframes.

Web Server Attack Methodology

A web mainframe hack normally includes preplanned exercises considered as an assault philosophy that an aggressor follows to arrive at the objective of penetrating the objective web worker’s security. Hackers misuse the web mainframe in different stages. At each stage, the assailant attempts to accumulate more data about the provisos and attempts to increase unapproved admittance to the web-server. Following are the phases of web mainframe’s hack methodology:

• Information Gathering: Each hacker attempts to gather however much data as could reasonably be expected about the target mainframe. The assailant assembles the data and afterward dissects the data so as to discover lapses in the current security design of the web mainframe.
• Web Server Foot-printing: The purpose of foot-printing is to accumulate more data about security parts of a web system with the assistance of devices or foot-printing procedures. The fundamental intention is to think about the web mainframe far off access capacities, its ports and benefits, and different parts of its security.
• Website Mirroring: It is a method of copying a website and it’s vulnerable content onto another server for offline browsing. With a mirrored website, a hacker can view the detailed structure of the website.
• Vulnerability Scanning: It is a method to find vulnerabilities and misconfiguration of a web server. Hackers scan for vulnerabilities with the help of automated tools known as vulnerability scanners.
• Session Hijacking: Hackers can perform session hijacking after identifying the current session of the client. The hacker takes over full oversight of the client session by utilizing the methods for implementing session hijacking.
• Web Server Passwords Hacking: Hackers use password-cracking methods such as brute force attacks, hybrid attacks, dictionary attacks, and so on, to crack the web server’s password.

If you liked this article please click the clap below. It’ll let me know you’d like to read more articles like this, and it’ll help other people discover the article as well.