CEHv10: Hacking Web Servers

Website Mirroring

This copies an entire website and its content onto the local drive HTTrack -an offline browser utility. It downloads a Website from the Internet to a local directory, building all directories recursively, getting HTML, images, and other files from the server. -HTTrack arranges the original site's relative link-structure. WebCopier Pro GNU Wget Website Ripper

Virtual Hosting

This is a technique of hosting multiple domains or websites on the same server. This allows sharing of resources between various servers. It is employed in large-scale companies where the company resources are intended to be accessed and managed globally. Types: o Name-based hosting o IP-based hosting o Port-based hosting

Why people think Web Servers are Compromised

Different people believe it is for different reasons Webmaster- The biggest security concern is that the web server can expose the local area network (LAN) or the corporate intranet to threats the Internet poses. Network Admin- A poorly configured web server poses another potential hole in the local network's security. End user -does not perceive any immediate threat, as surfing the web appears both safe and anonymous

Finding Directory Listings of Web Server

When a web server receives a request for the directory rather than the actual file, the web server responds to the request in the following ways: Return Default Resource within directory - It may return a default resource within the directory, such as index.html Return Error -It may return an error, such as the HTTP status code 403, indicating that the request is not permitted Return listing of directory content -It may return a listing showing the contents of the directory. A sample directory listing is illustrated in the below screenshot.

Defend Against DNS Hijacking

o Choose an ICANN accredited registrar and encourage them to set Registrar-Lock on the domain name o Safeguard the registrant account information o Include DNS hijacking into incident response and business continuity planning o Use DNS monitoring tools/services to monitor DNS server IP address and alert Avoid downloading audio and video codecs and other downloaders from untrusted websites Install antivirus program and update it regularly

Web Server Attacks

o DoS/DDoS Attacks o DNS attacks -Hijacking - Amplification o Directory Tranversal Attack o MiTM/ Sniffinng Attack o Phishing o Website Defacemnt o Web Server Misconfiguration o HTTP Response-Splitting Attack o Web Cache Poisoning Attack o SSH Brute Force Attack o Web Server Password Cracking -Guessing -Dictionary - Brute Force -Hybrid o Web Application Attack -Parameter/Form Tampering -Cookie Tampering -Unvalidated Input and File Injection Attacks -SQL Injection Attacks -Session Hijacking -Directory Traversal -DoS and XSS -Buffer Overflow -CSRF -Command Injection -Source Code Disclosure

Code Access Security

o Implement secure coding practices to avoid source code disclosure and input validation attack. o Restrict code access security policy settings to ensure that code downloaded from the Internet or intranet has no permissions to execute. o Configure IIS to reject URLs with "../" to prevent path traversal, lock down system commands and utilities with restrictive access control lists (ACLs), and install new patches and updates. o If targets do not implement code access security in their web servers, then there is a possibility of execution of malicious code.

Web Server Methodology

o Information gathering o Webserver Footprinting o Website Mirroring o Vulnerabiltiy scanning o Session Hijacking o Web Server Password Hacking

How to Defend Against Web Server Attacks

o Monitor all ports o Server certificates o Machine.config o Code Access Security o UrlScan

Web Server Penetration Testing Tools

CORE Impact® Pro -finds vulnerabilities on an organization's web server. This tool allows a user to evaluate the security posture of a web server using the same techniques employed by today's cyber-criminals Immunity CANVAS Arachni WebSurgery

Web Server Security Tools

Acunetix Web Vulnerability Scanner -scans websites and detects vulnerabilities. - detects application languages, web server types, and smartphone-optimized sites -crawls and analyzes different types of websites including HTML5, SOAP and AJAX. -supports scanning of network services running on the server and port scanning of the web server. Fortify WebInspect Retina CS Nscan NetIQ Secure Configuration Manager SAINT Scanner Infiltrator

HTTP Response Splitting Atk

Adding header response data to input field so that the server splits the response into two parts -This type of attack exploits vulnerabilities in input validation -Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and SQL Injection are some of the examples of this type of attack

Web Server Password Cracking

An attacker tries to exploit weaknesses to hack well-chosen passwords Attacker target SMTP and FTP servers, Web shares' SSH tunnel, and Web form authentication cracking Techniques used -Guessing -Dictionary attack -has predefined file of words of various combinations, and an automated program -Brute Force Attack -Hybrid Attack - uses both dictinary, brute force, symbols and numbers (easiest)

MITM/Sniffing Atk

In these attacks, an intruder intercepts or modifies the messages exchanged between the user and web server through eavesdropping or intruding into a connection The attacker lures the victim to connect to the web server by pretending to be a proxy. If the victim believes and agrees to the attacker's request, then all the communication between the user and the web server passes through the attacker. In this way, the attacker can steal sensitive user information.

Web Server Passwords Hacking Tools

In this phase of web server hacking, an attacker tries to crack web server passwords Hashcat -A Multi-OS, Multi-Platform compatible cracker that can perform Multi-Hash (MD4, 5; SHA - 224, 256, 384, 512; RIPEMD-160 etc.), -Multi-Devices password cracking. -The attack modes of this tool are straight, combination, brute force, Hybrid dict + mask, and Hybrid mask + dict. Ncrack Rainbow crack THC Hydra Wfuzz Medusa Wireshark

Server certificates

It guarantee security by providing certificates signed from a trusted authority. However, an attacker may compromise certified servers using forged certificates in order to intercept the secure communication by performing MITM attacks

Default Content of Web Servers

Most of the web applications' servers contain default content and functionalities allowing attackers to leverage attacks. Most common -Administrators debug and test functionality -Sample functionality to demonstrate common tasks -Publically accessible powerful functions -Server installation manuals Nikto2 -a vulnerability scanner that is used extensively to identify potential vulnerabilities in web applications and web servers.

Information Gathering

The first and one of the important steps toward hacking a target web server. Attackers may search the Internet, newsgroups, bulletin boards, and so on for information about the target organization. Tools whois.net -Lets you perform a domain whois search, whois IP lookup, and search the whois database for relevant information on domain registration and availability. Robots.txt -A website owner creates robots.txt file to list for a web crawler those files or directories it should index in search results.

Finding Exploitable Vulnerabilities

The software designing flaws and programming errors lead to security vulnerabilities. An attacker takes advantage of these vulnerabilities to perform various attacks on confidentiality, availability, or integrity of a system. Attackers exploit these software vulnerabilities such as programming flaws in a program, service, or within the OS software or kernel to execute malicious code

DNS Server Hijacking

This attack compromises DNS Server & changes the settings so that the user requests are misdirected to malicious site

DoS/DDoS

This attack involves flooding targets with numerous fake requests so that the target stops functioning and will be unavailable to the legitimate users. To crash the web server running the application, attacker targets the following services by consuming the web server with fake requests. - Network bandwidth - Server memory - Application exception handling mechanism - CPU usage - Hard disk space - Database space

Web Cache Poisoning Attack

This attacks the reliability of an intermediate web cache source. In this attack, the attackers swap cached content for a random URL with infected content. An attacker forces the web server's cache to flush its actual cache content and sends a specially crafted request to store in cache. These attacks are possible if the web server and application has HTTP Response-Splitting flaws.

Vulnerability Scanning

This determines vulnerabilities and misconfigurations of a target web server or a network. Vulnerability scanning finds possible weaknesses in a target server to exploit in a web server attack. Acunetix -scans websites and detects vulnerabilities. -checks web applications for SQL injections, XSS, -It supports testing of web forms and password protected areas, pages with CAPTCHA, single sign-on, and two-factor authentication mechanisms. Nessus Paros Fortify Webinspect

Web Server

This is a computer system that stores, processes, and delivers web pages to the global clients via HTTP protocol. Depending on the request, the this collects the requested information/content from the data storage or from the application servers and responds to the client's request with an appropriate HTTP response. If it cannot find the requested information, then it generates an error message

Hotfixes

This is a package used to address a critical defect in a live environment, and contains a fix for a single issue. It updates a specific version of a product. It provide solutions faster and ensure that the issues are resolved. Apply these to software patches on production systems. These are an update to fix a specific customer issue and not always distributed outside the customer organization.

UrlScan

This is a security tool that restricts the types of HTTP requests that Microsoft IIS will process. By blocking specific HTTP requests, this security tool helps prevent potentially harmful requests from reaching the server. It is implemented as an ISAPI filter that screens and analyzes HTTP requests as IIS receives them. When properly configured, it is effective at reducing the exposure of IIS to potential Internet attacks. Administrators may configure it to reject HTTP requests

IIS Web Server Architecture

This is a web server application developed by Microsoft for Windows. It is a flexible, secure, and easy-to-manage web server for hosting anything on the web. It supports HTTP(80), HTTPS(443), FTP(20/21), FTPS(990), SMTP(25), and NNTP(119)

Document Root

This is one of the web server's root file directories that stores critical HTML files related to the web pages of a domain name that will serve in response to the requests.

Directory Traversal

This is the exploitation of HTTP through which attackers can access restricted directories and execute commands outside of the web server's root directory by manipulating a URL. -A web server is vulnerable to this attack if it accepts input data from a browser without proper validation. -attackers use ../ (dot-dot-slash) sequence to access restricted directories -poorly patched or configured web server software can make the web server itself vulnerable to this attack -Attackers can use the trial-and-error method to navigate outside of the root directory and access sensitive information in the system.

Machine.config

This is the mechanism of securing information by changing the machine level settings. This can o ensure that protected resources are mapped to HttpForbiddenHandler and unused HttpModules are removed o ensure that tracing is disabled and debug compiles are turned off o validate that ASP.NET errors are not reverted back to the client o verify session state settings

Server Root

This is the top-level root directory under the directory tree in which the server's configuration and error, executable, and log files are stored. It consists of the code that implements the server. In general, it consists of four files where one file is dedicated to the code that implements the server and other three are subdirectories, namely, -conf, -logs, and -cgi-bin used for configuration information, store logs, and executables, respectively.

Virtual Document Tree

This provides storage on a different machine or a disk after the original disk is filled-up. It is case sensitive and can be used to provide object-level security.

Web Server Misconfiguration

This refers to the configuration weaknesses in web infrastructure that can be exploited to launch various attacks on web servers such as directory traversal, server intrusion, and data theft - Verbose Debug/Error Messages - Anonymous or Default Users/Passwords - Sample Configuration and Script Files - Remote Administration Functions - Unnecessary Services Enabled - Misconfigured/Default SSL Certificates

Website Defacement

This refers to the unauthorized changes made to the content of a single web page or an entire website, resulting in changes to the visual appearance of the website or a web page. -Hackers injecting code to add images, popups, or text to a page -Attacker may replace the entire website instead of just changing single pages. -Attackers use MySQL injection to access a website in order to do this

Web Proxy

This sits in between the web client and web server. Due to the placement, all the requests from the clients will be passed on to the web server through this. They are used to prevent IP blocking and maintain anonymity.

Open Source Web Server Architecture

This typically uses Linux, Apache, MySQL, and PHP (LAMP) as principal components. -Linux is the server's OS that provides secure platform for the web server -Apache is the web server component that handles each HTTP request and response -MySQL is a relational database used to store the web server's content and configuration information -PHP is the application layer technology used to generate dynamic web content

Web Server Attack Tools

Wfetch -a IIS Server Resource Kit tool that allows attacker to fully customize an HTTP request and send it to a web server to see the raw HTTP request and response data. -It allows attacker to test the performance of websites that contain new elements such as Active Server Pages (ASP) or wireless protocols THC Hydra Hulk DoS MPack w3af

Web Server Operations

Components of a Web Server -Document Root -Server Root -Virtual Document Tree -Virtual Hosting -Web Proxy

Countermeasures: Protocols

Block all unnecessary ports, Internet Control Message Protocol (ICMP) traffic, and unnecessary protocols such as NetBIOS and SMB. Harden the TCP/IP stack and consistently apply the latest software patches and updates to system software. If using insecure protocols such as Telnet, POP3, SMTP, and FTP, then take appropriate measures to provide secure authentication and communication, for example, by using IPSec policies. If remote access is needed, make sure that the remote connection is secured properly, by using tunneling and encryption protocols. Disable WebDAV if not used by the application or keep secure if it is required

Nmap

Discover virtual domains with hostmap *$nmap --script hostmap* Detect a vulnerable server that uses the TRACE method *nmap --script http-trace -p80 localhost* Harvest email accounts with http-google-email *$nmap --script http-google-email* Enumerate users with http-userdir-enum *nmap -p80 --script http-userdir -enum localhost* Detect HTTP TRACE *$nmap -p80 --script http-trace* Enumerate common web applications *$nmap --script http-enum -p80* Obtain robots.txt *$nmap -p80 --script http-robots.txt*

Countermeasures: Files and Directorie

Eliminate unnecessary files within the .jar files. Eliminate sensitive configuration information within the byte code. Avoid mapping virtual directories between two different servers, or over a network. Monitor and check all network services logs, website access logs, database server logs (e.g., Microsoft SQL Server, MySQL, and Oracle), and OS logs frequently. Disable serving of directory listings. Eliminate the presence of non-web files such as archive files, backup files, text files, and header/include files. Disable serving certain file types by creating a resource mapping. Ensure the presence of web application or website files and scripts on a separate partition or drive other than that of the OS, logs, and any other system files

Countermeasures: Accounts

Remove all unused modules and application extensions. Disable unused default user accounts created during installation of an OS. When creating a new web root directory, grant the appropriate (least possible) NTFS permissions to the anonymous user being used from the IIS web server to access the web content. Eliminate unnecessary database users and stored procedures and follow the principle of least privilege for the database application to defend against SQL query poisoning. Use secure web permissions, NTFS permissions, and .NET Framework access control mechanisms including URL authorization. Slow down brute force and dictionary attacks with strong password policies, and then audit and alert for logon failures. Run processes using least privileged accounts as well as least privileged service and user accounts.

Methods to Compromise a Web Server

- Improper file and directory permissions - Installing the server with default settings - Unnecessary services enabled, including content management and remote administration - Security conflicts with business ease-of-use case - Lack of proper security policy, procedures, and maintenance - Improper authentication with external systems - Default accounts with their default or no passwords - Unnecessary default, backup, or sample files - Misconfigurations in web server, OS, and networks - Bugs in server software, OS, and web applications - Misconfigured SSL certificates and encryption settings - Administrative or debugging functions that are enabled or accessible on web servers - Use of self-signed certificates and default certificates

Dangerous Security Flaws Affecting Web Server Security

- Not updating the web server with the latest patches - Using the same system admin credentials everywhere - Allowing unrestricted internal and outbound traffic - Running unhardened applications and servers - Complacency

Countermeasures: Patches and Updates

- Scan for existing vulnerabilities, patch, and update the server software regularly. - Before applying any service pack, hotfix, or security patch, read and peer review all relevant documentation. - Apply all updates, regardless of their type on an "as-needed" basis. - Test the service packs and hotfixes on a representative non-production environment prior to being deployed to production. - Ensure that service packs, hotfixes, and security patch levels are consistent on all Domain Controllers (DCs). - Ensure that server outages are scheduled and a complete set of backup tapes and emergency repair disks are available. - Have a back-out plan that allows the system and enterprise to return to their original state, prior to the failed implementation. - Schedule periodic service pack upgrades as part of operations maintenance and never try to have more than two service packs behind.

Goals behinh Web Server Attacks

- Stealing credit cards or other sensitive credentials using phishing techniques - Integrating the server in a botnet in order to perform Denial of Service (DoS) or Distributed Denial of Service (DDoS) attack - Compromising a database - Obtaining closed-source applications - Hiding and redirecting traffic - Escalating privileges

Web Server Pen Testing

1. Identify the Traget 2. Search for information about the target 3. Social Engineering 4. Query the Whois Database 5. Document 6. Fingerprint web server 7. Crawl website 8. Enumerate web server directories 9. Perform directory traversal attack 10. Perform vulnerability scanning 11. Perform HTTP response-splitting attack 12. Perform web cache poisoning attack 13. Brute force SSH, FTP, and other services login credentials 14. Perform MITM attack 15. Perform web application penetration testing

Countermeasures

1. Place Web Servers in Separate Secure Server Security Segment on Network -The first step in securing web servers is to place them separately in DMZ that is isolated from public network as well as internal network in the web-hosting network.

Patch Management

A defense against vulnerabilities that cause security weakness, or corrupts data. It is a process of scanning for network vulnerabilities, detecting the missed security patches and hotfixes and then deploying the relevant patches as soon as they are available to secure the network. It involves the following: - Choosing, verifying, testing, and applying patches - Updating previously applied patches with current patches - Listing patches applied previously to the current software - Recording repositories, or depots, of patches for easy selection - Assigning and deploying the applied patches Tools -Symantec Client Management Suite -MaaS360 Patch Analyzer -Solarwinds Patch Manager -BatchPatch -Patch Connect Plus

GFI LanGuard

A patch management scans your network automatically and also installs and manages security and non-security patches. It supports machines across Microsoft®, MAC OS X® and Linux® operating systems as well as many third-party applications. It allows auto-downloads of missing patches as well as patch rollback, resulting in a consistently configured environment that is protected from threats and vulnerabilities.

Metasploit

A penetration-testing toolkit, exploit development platform, and research tool that includes hundreds of working remote exploits for a variety of platforms. It supports fully automated exploitation of web servers by abusing known vulnerabilities and leveraging weak passwords via Telnet, SSH, HTTP, and SNM. Features of Metasploit that an attacker may use to perform web server attack: - Closed-loop Vulnerability Validation - Phishing Simulations Social Engineering - Manual Brute Forcing - Manual Exploitation - Evade-leading defensive solution Modules Exploit Module - used to encapsulate an exploit using which users target many platforms with a single exploit. Payload Module -o Singles: It is self-contained and completely standalone -o Stagers: It sets up a network connection between the attacker and the victim -o Stages: It is downloaded by stagers modules Auxiliary Module - can be used to perform arbitrary, one-off actions such as port scanning, DoS, and even fuzzing. NOPS Module- "generate" (-b, -h, -s, -t, msf nop opty2) -generate no-operation instructions used for blocking out buffers.

Patch

A small piece of software designed to fix problems, security vulnerabilities, and bugs, and improve the usability or performance of a computer program or its supporting data.

Impact of Web Server Attacks

Attackers can cause various kinds of damages to an organization by attacking a web server -Compromise of User Account -Website Defacement -Secondary Attacks from the website -Root access to other apps/servers -Data tampering/theft

Phishing Attacks

Attackers perform this attack by sending an email containing a malicious link and tricking the user to click it. Clicking the link will redirect the user to a fake website that looks similar to the legitimate website.

SSH Brute Force Attack

Attackers use the SSH protocols to create an encrypted SSH tunnel between two hosts in order to transfer unencrypted data over an insecure network. The attacker scans the entire SSH server using bots (performs TCP port 22 port scan) to identify possible vulnerabilities Attackers use tools such as Nmap and ncrack on a Linux platform to perform this attack

Web Server Footprinting/Banner Grabbing

By performing this, you can gather valuable system-level data such as account details, OS, software versions, server names, and database schema detail Netcat -This is a networking utility that reads and writes data across network connections, using the TCP/IP protocol. -It is a reliable "back-end" tool used directly or driven by other programs and scripts. -It is also a network debugging and exploration tool. Telnet -is a network protocol. It is widely used on the Internet or LANs. It is a client-server protocol. It provides the login sessions for a user on the Internet. The single terminal attached to other computer emulates with Telnet. The primary security problems with Telnet are the following: -o It does not encrypt any data sent through the connection. -o It lacks an authentication scheme. Netcraft -determines the OS of the queried host by looking in detail at the network characteristics of the HTTP response received from the website httprecon -is a tool for advanced web server fingerprinting. This tool performs banner-grabbing attacks, status code enumeration, and header ordering analysis on the target web server ID Serve -a simple Internet server identification utility -Does server identification and reverse DNS lookup Recon-ng - footprinting tool

Web Application Attacks

Can be performed if the web developers do not adopt secure coding practices while developing web applications. Types Parameter/Form Tampering -In this type of tampering attack, the attacker manipulates the parameters exchanged between client and server in order to modify application data, such as user credentials and permissions, price and quantity of products, and so on. Cookie Tampering -occur when sending a cookie from the client side to the server. Different types of tools help in modifying persistent and non-persistent cookies Unvalidated Input and File Injection Attacks - attacks are performed by supplying an unvalidated input or by injecting files into a web application SQL Injection Attacks -exploits the security vulnerability of a database for attacks. The attacker injects malicious code into the strings, later passed on to the SQL Server for execution Session Hijacking -an attack in which the attacker exploits, steals, predicts, and negotiates the real valid web session's control mechanism to access the authenticated parts of a web application. Directory Traversal -the exploitation of HTTP through which attackers can access restricted directories and execute commands outside of the web server's root directory by manipulating a URL. DoS -intended to terminate the operations of a website or a server and make it unavailable for access by intended users. XSS -intended to terminate the operations of a website or a server and make it unavailable for access by intended users. Buffer Overflow -attacker uses this advantage and floods the application with too much data, which in turn causes a buffer overflow attack. CSRF -attacker exploits the trust of an authenticated user to pass malicious code or commands to the web server. Command Injection - a hacker alters the content of the web page by using html code and by identifying the form fields that lack valid constraints. Source Code Disclosure- a result of typographical errors in scripts or because of misconfiguration, such as failing to grant executable permissions to a script or directory. This disclosure can sometimes allow the attackers to gain sensitive information about database credentials and secret keys and compromise the web servers

More ways to defend against DNS Hijacking

Change the default router password that comes with the factory settings Domain Name System Security Extensions (DNSSEC): It adds an extra layer to DNS that prevents DNS from being hacked. Strong Password Policies and User Management: Use of strong passwords further enhances the security. Better Service Level Agreements (SLAs) from DNS Service Providers: When signing up to DNS servers with DNS service providers, learn who to contact when there is an issue, how to receive better quality of reception and support, and whether the DNS server's infrastructure is hardened against attack, and so on. Configuring a Master-Slave DNS within your Network: Use a Master-Slave DNS and configure the master without internet access. Maintain two slave servers instead, so that even if someone hacks a slave, it will update only when it receives an update from the master. Constant Monitoring of DNS Servers: Constant monitoring of DNS server ensures that a website is returning the correct IP address.

Finding Default Credentials of Web Server

Finding this can gain access to the administrative interface compromising the respective web server and indeed allowing the attacker to exploit the main web application itself cirt.net -A is the lookup database for default passwords, credentials, and ports. open-sez.me fortypoundhead.com defaultpassword.us

Web Server Malware Infection Monitoring Tool

QualysGuard Malware Detection Service (MDS) Enterprise Edition -allows organizations to proactively scan their websites for malware, providing automated alerts and in-depth reporting to enable prompt identification and resolution. -enables businesses to scan and manage a large number of sites, preventing website blacklisting. Sucuri Quttera Web Inspector

DNS Amplification Attack

Recursive DNS Query is a method of requesting DNS mapping. The query goes through domain name servers recursively until it fails to find the specified domain name to IP address mapping. Attackers exploit recursive DNS queries to perform a this attack that results in DDoS attacks on the victim's DNS server After the primary DNS server finds the DNS mapping for the victim's request, it sends a DNS mapping response to the victim's IP address. This response goes to the victim as bots are using the victim's IP address. The replies to a large number of DNS mapping requests from the bots result in DDoS on the victim's DNS server.

Web Server Security Scanners

ScanMyServer -is used to find security vulnerabilities in a website or a web server. It can generate comprehensive test reports and also can assists in fixing security problems that might exist in company's website or web server Nikto2 Qualys FreeScan UrlScan

Defend Against HTTP Response Split & Web Cache Poison

Server Admin- o Use latest web server software o Regularly update/patch OS and web server o Run web Vulnerability Scanner App Devs- o Restrict web application access to unique IPs o Disallow carriage return (%0d or \r) and line feed (%0a or \n) characters o Comply to RFC 2616 specifications for HTTP/1.1 Proxy Server- o Avoid sharing incoming TCP connections among different clients o Use different TCP connections with the proxy for different virtual hosts o Implement "maintain request host header" correctl

Session Hijacking

Sniff valid session IDs to gain unauthorized access to the web server and snoop the data Burp Suite, -a web security testing tool that can hijack the session identifiers in established sessions. The Sequencer tool in Burp Suite tests the randomness of session tokens. With this tool, an attacker can predict the next possible session ID token, and use that to take over a valid session Firesheep, JHijack Ettercap Cookie Catcher Cookie Cadger

Reasons for attack

Some attacks are not made to attain financial gains, but for personal reasons: - For the sake of pure curiosity - For the sake of achieving a self-set intellectual challenge - To damage the target organization's reputation

Web Application Security Scanners

Syhunt Hybrid -scanner automates web application security testing and guards the organization's web infrastructure against web application security threats. -crawls websites and detects XSS, directory transversal problems, fault Injection, SQL Injection, attempts to execute commands, and multiple other attacks N-Stalker -a WebApp Security Scanner that searches for vulnerabilities such as Clickjacking, SQL injection, XSS, and known attacks -This tool checks for Web Signature attacks, Cookie Exposure, and so on and every known Web development platform is supported which interacts through the HTTP protoco Skipfish Burp Suite Netsparker Web Application Security Scanner Detectify

Using App Server as a Proxy

Web servers with these functions enabled are employed by the attackers to perform following attacks: - Attacking third-party systems on internet - Connecting to arbitrary hosts on the organization's internal network - Connecting back to other services running on the proxy host itsel Attackers use GET and CONNECT requests to use vulnerable web servers as proxies to connect and obtain information from target systems through these web servers.