Hacking Web Servers

Hacking Web Servers

A web server, which can be referred to as the hardware,the computer or the software is the computer application that helps to deliver content that can be accessed through the internet

Most of online services are implemented as web applications, online banking,web search engines,email application and social networks are just a few examples of such web service. Web content is generated in real time by a software application running at server side, so hackers attack on the web server to steal credential information,passwords and business information by DOS attacks,SYN floods,ping floods,port scan,sniffing attacks,and social engineering attacks.

Systems are constantly being attacked and IT security professionals need to be aware of common attacks on the web server applications.Attackers can capture the data packets and uses to sniff to read the data.

For an attacker is to gain access to the network to capture the data, if attackers is to gain access to the network.

If attackers have physical access to a router or switch they can connect the sniffer and capture all trafic going through the system,strong physical security measures help migrate this risk.

As a Penetration tester and ethical hacker ,you must provide security to the company web server ,you must perform checks on the web server for vulnerabilities,is configuration, un patched security flaws and authentication with external systems.

• IIS Webserver Architecture
• Why Web Server are Compromised
• Impact of Webserver Attacks
• Webserver Attacks
• Webserver Attack Methodology
• Webserver Attack Tools
• Metasploit ArchitectureSec
• Web password cracking tools
• Patch management
• Defend against web server
• Webserver Server security tools
• Webserver pen testing

IIS Web server Architecture

Internet Information Services for windows server is a flexible, secure,and easy to manage web server for hosting anything on the web

Why Web Server are Compromised

• Security conflicts with the business ease of use,improper file and directory permisions
• misconfiguration in webserver,operating systems and networks
• improper authentication with external systems
• use of self signed certificates and default certificates

Impact of web server Attacks

Compromise of user accounts

Data Tampering

Website defacement

Secondary attacks from the website

Data theft

Root access to other applications or servers

\

Web Server Misconfiguration

Server misconfiguration refers to configuration weakness in web infrastructure that can be exploited to launch various attacks on web servers such as directory traversal server intrusion and data theft

Web Application Attacks

Vulnerabilities in web application running on a webserver provide a broad attack path for webserver compromise

Web server Attack Methodology 

valuable system level information such as account details,operating system,software versions,server name and database schema details

Vulnerability Scanning

Scanning a identify weakness in a network and determine the system can be exploited

network traffic to find out active systems,network services,applications and vulnerablities

Metasploit Exploit

It is the basic Module in metasploit used to encapsulate an exploit using users target many platforms with a single exploits