Popular Web Servers : Hacking Web Servers

<div dir="ltr" style="text-align: left;" trbidi="on"> <br /> <div class="separator"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhe8Wsar8QnZKYzupW_QVFoFesAX_3SJrnOV2P3aV2ddmnmFtUCz5F4OUss3bwN7yBz0X6AhLLsmEBs2Ag_qBc43PegiUfPK4BesbYHE9oWQ5xGBlTE73t8cEAh6DMJBOSf1Oh1Or7X1eQ9/s1600/Server-Hacking.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="213" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhe8Wsar8QnZKYzupW_QVFoFesAX_3SJrnOV2P3aV2ddmnmFtUCz5F4OUss3bwN7yBz0X6AhLLsmEBs2Ag_qBc43PegiUfPK4BesbYHE9oWQ5xGBlTE73t8cEAh6DMJBOSf1Oh1Or7X1eQ9/s320/Server-Hacking.jpg" width="320" /></a></div> <br /> The popular web servers are Apache Web Server, Internet Information Server and Sun ONE Web Server.<br /> The Apache Web Server is an open-source web server for modern operating systems including UNIX and Windows NT. The server provides HTTP services in sync with the current HTTP standards in an efficient and extensible environment.<br /> <br /> The Java Web Server / Sun ONE Web Server is one of the other highly available Web servers on the market. Microsoft's Internet Information Server is another popular server used by a sizable percentage of websites.<br /> <table border="0" cellpadding="0" cellspacing="0" class="note"><tbody> <tr><td class="admon-check" valign="top"></td><td class="admon-title" valign="top" width="56"><br /> Threat</td><td class="admon-body" valign="top"><br /> <b class="bold">Common Security Risks</b><br /> <br /> Let us take a look at some of the security concerns that arise in the context of web servers. There are inherent security risks that affect web servers, the local area networks that host these web sites, and perhaps even the normal users of web browsers.</td></tr> </tbody></table> <br /> <div class="section" style="margin: 0px 27px; padding: 0px;"> <h4> Webmaster's Concern</h4> <br /> From a webmaster's perspective, the biggest security concern is that the web server can expose the local are network or the corporate intranet to the threats posed by the Internet. This may be in the form of virus, Trojans, hackers or compromise of information itself. It is often considered that software bugs present in large complex programs are the source of imminent security lapses. Web servers, being large complex devices do come with these inherent risks. Apart from this, the open architecture of some Web servers allows arbitrary scripts to be executed on the server's side of the connection in response to remote requests. Any CGI script installed at the site may contain bugs that are potential security holes.</div> <br /> <div class="section" style="margin: 0px 27px; padding: 0px;"> <h4> Network Administrator's Concern</h4> <div class="first-para"> From a network administrator's perspective, a poorly configured web server poses another potential hole in the local network's security. While the objective of a web site is to provide controlled access to the network, too much of control can make a Web site impossible to use. In an intranet environment, the network administrator has to careful about configuring the web server such that legitimate users are recognized and authenticated and various groups of users assigned distinct access privileges.</div> </div> <div class="section" style="margin: 0px 27px; padding: 0px;"> <h4> End User's Concern</h4> <div class="first-para"> Usually the end user does not perceive any immediate threat, as surfing the web appears both safe and anonymous. However, active content, such as ActiveX controls and Java applets, makes it possible for harmful applications such as viruses to invade the user's system. Besides, active content from a web browser can be a conduit for malicious software to bypass the firewall system and permeate the local area network.</div> <div class="last-para"> The threat for the end user stems from the fact that the TCP/IP protocol was not designed with security as its foremost priority. Therefore, data can be compromised in terms of confidentiality, authentication, and integrity as it is transmitted across the Web. In essence the aspects of confidentiality, authentication, and integrity need to be guarded both on the client side and server side to the extent possible.</div> </div> <div class="section" style="margin: 0px 27px; padding: 0px;"> <h4> Risks</h4> <div class="first-para"> There are basically three overlapping types of risk:</div> <ol class="orderedlist"> <li class="first-listitem" style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;"> <div class="first-para"> Bugs /misconfiguration problems in the Web server that allow unauthorized remote users to:</div> <ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;"> <li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para"> Steal classified information.</div> </li> <li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para"> Execute commands on the server host machine and modifying the system.</div> </li> <li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para"> Retrieve host based information to assist them in compromising the system.</div> </li> <li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para"> Launch denial-of-service attacks, rendering the machine temporarily unusable.</div> </li> </ul> </li> <li class="listitem" style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;"> <div class="first-para"> Browser-side risks</div> <ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;"> <li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para"> Active content that crashes the browser, damages the user's system, breaches the user's privacy, or merely creates a disturbance.</div> </li> <li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para"> The misuse of personal information provided by the end-user.</div> </li> </ul> </li> <li class="listitem" style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;"> <div class="first-para"> Interception of network data sent from browser to server or vice versa via network eavesdropping. Eavesdroppers can operate from any point on the pathway between browser and server including:</div> <ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;"> <li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para"> The network on the browser's side of the connection.</div> </li> <li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para"> The network on the server's side of the connection (including intranets).</div> </li> <li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para"> The end-user's Internet service provider (ISP).</div> </li> <li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;"> <div class="first-para"> The server's ISP or regional access provider.</div> </li> </ul> </li> </ol> </div> </div>

Hacking Risks Server Vulnerability Popular Web Servers : Hacking Web Servers

The popular web servers are Apache Web Server, Internet Information Server and Sun ONE Web Server. The Apache Web Server is an open-so...

Read more »