Web and Database Hacking

• Perform system hacking, and web and database attacks.

• Web server vulnerabilities, tools, and exploits
• Web application vulnerabilities, tools, and exploits
• Database attacks and attack tools

• A web server is a computer system that stores, processes, and delivers web pages to global clients via the Hypertext Transfer Protocol (HTTP).
• In general, a client initiates a communication process through HTTP requests. When a client desires to access any resource such as web pages, photos, and videos, the client’s browser generates an HTTP request that is sent to the web server. Depending on the request, the web server collects the requested information/content from the data storage or application servers and responds to the client’s request with an appropriate HTTP response.
• If a web server cannot find the requested information, then it generates an error message.

❖ A web server is a hardware/software application that hosts websites and makes them

accessible over the internet.

❖ A web server, along with a browser, successfully implements client-server model architecture

in which the web server plays the server part in the model and the browser acts as the client.

❖ To host websites, a web server stores various web pages of the websites and delivers the

web page upon request.

❖ Each web server has a domain name and the IP address associated with that domain name.

❖ A web server can host more than one website.

❖ Any computer can act as a web server if it has specific server software (a web server

program) installed in it and is connected to the internet.

❖ Web servers are chosen based on their capability to handle server-side programming, security

characteristics, publishing, search engine, and site-building tools.

❖ An attacker usually targets vulnerability that exists in the software component and

configuration errors to compromise web servers.

Attackers perform web server attacks with certain goals in mind. These goals may be either technical or non-technical. For example, attackers may breach security of the web server and steal sensitive information for financial gains or only for the sake of curiosity. Following are some goals behind a web server attack:

• Stealing credit cards or other sensitive credentials using phishing techniques
• Integrating the server in a botnet in order to perform Denial of Service (DoS) or Distributed Denial of Service (DDoS) attack
• Compromising a database
• Obtaining closed-source applications
• Hiding and redirecting traffic
• Escalating privileges

Some attacks are performed for personal reasons, rather than financial gains:

For pure curiosity For completing a self-set intellectual challenge For damaging the target organization’s reputation

• Security Web server configuration by poorly trained system administrators may leave security vulnerabilities in the web server.
• Inadequate knowledge, negligence, laziness, and inattentiveness toward security can pose the biggest threats to web server security.

Following are some of the common oversights that make a web server vulnerable to attacks:

• Not updating the web server with the latest patches
• Using the same sys admin credentials everywhere
• Allowing unrestricted internal and outbound traffic
• Running unhardened applications and servers

• Web servers may expose internal networks
• Risks include vulnerable scripts and backend code
• Open architecture allows server-side execution
• A single flaw can compromise the server

• Poor configuration creates security gaps
• Weak authentication and access control
• Excessive privileges granted
• Misconfiguration is a major attack vector

• Users assume web browsing is safe
• Malicious web content can deliver malware
• Client-side scripts can be exploited
• Compromised servers can attack users

• Unpatched software
• Poor security configuration
• Vulnerable web applications
• Weak authentication
• Human error

• Administrator negligence
• Lack of security awareness
• Default credentials
• Unnecessary services enabled

• A poorly configured web server can bypass firewalls
• Network security alone is insufficient
• Web server security is critical

• Data theft and tampering
• Website defacement
• Malware distribution
• Privilege escalation
• Secondary attacks

• Buffer overflow
• Denial of service (DoS) attack
• Distributed denial of service (DDoS) attack
• Banner information
• Permissions
• Error messages
• Unnecessary features
• User accounts
• Structured Query Language (SQL) injections

• Domain Name System (DNS) resolves a domain name to its corresponding IP address. A user queries the DNS server with a domain name, and it delivers the corresponding IP address. In a DNS server hijacking, an attacker compromises the DNS server and changes the mapping settings of the target DNS server to redirect toward a rogue DNS server so that it would redirect the user’s requests to the attacker’s rogue server. Thus, when the user types the legitimate URL in a browser, the settings will redirect to the attacker’s fake site.

Web cache poisoning attacks the reliability of an intermediate web cache source.

In this attack, the attackers swap cached content for a random URL with infected content. Users of the web cache source can unknowingly use the poisoned content instead of true and secured content when requesting the required URL through the web cache. An attacker forces the web server s cache to flush its actual cache content

’

and sends a specially crafted request to store in cache. In this case, all the users of that web server cache will get malicious content until the servers flush the web cache.

Web cache poisoning attacks are possible if the web server and application has HTTP Response-Splitting flaws.

• Servers should be purpose-built to the role they will fill in the organization.
• Anything not essential to this role should be eliminated
• Hardening removes features, services, and applications that are not necessary for a system to do its appointed job.
• If a feature or service is not needed, it should be disabled or, better yet, uninstalled.

• Even if web servers are configured securely or are secured using network security measures such as firewalls, a poorly coded web application deployed on the web server may give a path to an attacker to compromise the web server’s security.
• If the web developers do not adopt secure coding practices while developing web applications, it may give attackers the chance to exploit vulnerabilities and compromise web applications and web server security. An attacker can perform different types of attacks on vulnerable web applications to breach web server security.

• Databases store critical and sensitive information
• Often connected to web applications
• A single weakness can expose entire systems
• Databases are high-value attack targets

• Weak or default passwords
• Excessive user privileges
• Unpatched database software
• Insecure configuration
• Lack of encryption

• Shared database accounts
• Weak authentication mechanisms
• No role-based access control
• Open database ports
• Poor backup protection

• Default settings left unchanged
• Unnecessary database services enabled
• Weak auditing and logging
• Inadequate monitoring
• Human configuration errors

• SQL Injection
• Credential brute-force attacks
• Privilege escalation
• Unauthorized data access
• Data manipulation attacks

• Abuse of stored procedures
• Exploitation of misconfigured permissions
• Password cracking attacks
• Bypassing authentication controls
• Insider attacks

• Data theft
• Data tampering or deletion
• Loss of confidentiality and integrity
• Service disruption
• Legal and reputational damage

• Common vulnerabilities include:
  • Used stored procedures
  • Services account privilege issues
  • Wear or poor authentication methods enabled
  • No or limited audit log settings

• Web server vulnerabilities, tools, and exploits
• Web application vulnerabilities, tools, and exploits
• Database attacks and attack tools