{"id":132,"date":"2018-07-12T06:54:57","date_gmt":"2018-07-12T06:54:57","guid":{"rendered":"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/?post_type=chapter&#038;p=132"},"modified":"2019-05-14T05:47:07","modified_gmt":"2019-05-14T05:47:07","slug":"web-threats","status":"publish","type":"chapter","link":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/chapter\/web-threats\/","title":{"rendered":"Web threats"},"content":{"raw":"<div><span style=\"float: right;\"><a href=\"https:\/\/youtu.be\/03onEk4lTGc\" target=\"_blank\" rel=\"noopener\"><img src=\"http:\/\/epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/2018\/11\/download.png\" alt=\"epgp books\" width=\"75px\" height=\"75px;\" \/><\/a>\r\n<\/span><\/div>\r\n\r\n<strong>Client Level Threats:<\/strong>\r\n<ul>\r\n \t<li>1) Cross site scripting attacks<\/li>\r\n \t<li>2) Unpatched Web clients<\/li>\r\n<\/ul>\r\n<strong>1) <\/strong><strong>Cross \u2013Site Scripting Attacks:\u00a0<\/strong>Attacker needs to\r\n<ul>\r\n \t<li>Inject HTML data into Web content<\/li>\r\n \t<li>Trick the user into visiting the XSS vulnerable website<\/li>\r\n \t<li>Cause the injected HTML data to execute on that user\u2019s browser<\/li>\r\n<\/ul>\r\nOpen Notepad, type following and store in server directory as test.jsp.\r\n\r\n&nbsp;\r\n\r\n&lt;html&gt;\r\n\r\n&lt;body&gt;\r\n\r\nHello\r\n\r\n&lt;%\r\n\r\nout.println(\"welcome\"+request.getParameter(\"name\") );\r\n\r\n%&gt;\r\n\r\nAhmedabad\r\n\r\n&lt;\/body&gt;\r\n\r\n&lt;\/html&gt;\r\n\r\n&nbsp;\r\n\r\nTry the following - <a href=\"http:\/\/localhost:8080\/css\/test.jsp?name=LDCE\">http:\/\/localhost:8080\/css\/test.jsp?name=LDCE<\/a>\r\n\r\n<img class=\"size-full wp-image-133 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-78.png\" alt=\"\" width=\"478\" height=\"555\" \/>\r\n\r\n<strong>Observation:<\/strong>\r\n<ul>\r\n \t<li>1) <a href=\"http:\/\/localhost:8080\/css\/test.jsp?name=LDCE\">http:\/\/localhost:8080\/css\/test.jsp?name=LDCE<\/a><\/li>\r\n \t<li>2) http:\/\/localhost:8080\/css\/test.jsp?name=&lt;script&gt;alert(\"hello\")&lt;\/script&gt; In the second case script code gets executed.<\/li>\r\n<\/ul>\r\n<strong>Countermeasures at Web application level:<\/strong>\r\n\r\n&nbsp;\r\n\r\n<strong>Educate developers<\/strong>\r\n\r\nSanitize and validate all inputs that could potentially be used as part of dynamically generated Web responses.\r\n<ul>\r\n \t<li><strong>Encode URL<\/strong><\/li>\r\n \t<li>URL encoding is normally performed to convert data passed via html forms, because such data may contain special character, such as \"\/\", \".\", \"#\", and so on, which could either:<\/li>\r\n<\/ul>\r\n<ol>\r\n \t<li>a) have special meanings;<\/li>\r\n \t<li>or b) is not a valid character for an URL;<\/li>\r\n \t<li>or c) could be altered during transfer.<\/li>\r\n<\/ol>\r\n<ul>\r\n \t<li>the \"#\" character has a special meaning so needs to be encoded.<\/li>\r\n \t<li>The &lt;space&gt; character also needs to be encoded because is not allowed on a valid URL format.<\/li>\r\n \t<li>Some characters, such as \"~\" might not transport properly across the internet.<\/li>\r\n<\/ul>\r\n<strong>Example<\/strong>\r\n<ul>\r\n \t<li>URL Encoding is visible when dealing with &lt;form&gt;s.<\/li>\r\n \t<li>Form methods (GET and POST) perform URL Encoding implicitly.<\/li>\r\n \t<li>Websites uses GET and POST methods to pass parameters between html pages.<\/li>\r\n \t<li>&lt;input type=\"text\" name=\"var\" size=\"50\" value=\"This is a simple &amp; short test.\"&gt;\r\n<ul>\r\n \t<li>&lt;form method=\"GET\" action=\"example.html\"&gt;<\/li>\r\n<\/ul>\r\n<\/li>\r\n \t<li>&lt;input type=\"submit\"&gt;\r\n<ul>\r\n \t<li>&lt;\/form&gt;<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ul>\r\n<img class=\"size-full wp-image-135 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-80.png\" alt=\"\" width=\"514\" height=\"160\" \/>\r\n<ul>\r\n \t<li>This sample &lt;form&gt; sends the data in the text field using the GET method, which means that the data will be appended as query string.<\/li>\r\n \t<li>If the button is clicked and the resulting URL in the browser address bar, automatically encoded by the browser:<\/li>\r\n \t<li><a href=\"http:\/\/www.permadi.com\/tutorial\/urlEncoding\/example.html?var=This+is+a+simple+%26+short+test\">http:\/\/www.permadi.com\/tutorial\/urlEncoding\/example.html?var=This+is+a<\/a> <a href=\"http:\/\/www.permadi.com\/tutorial\/urlEncoding\/example.html?var=This+is+a+simple+%26+short+test\">+simple+%26+short+test.<\/a><\/li>\r\n \t<li>The <strong>&lt;space&gt;<\/strong> character has been URL encoded as \"+\".<\/li>\r\n \t<li>The <strong>&amp;<\/strong> character has been URL encoded as \"%26\".<\/li>\r\n<\/ul>\r\n<strong>HTML Encoding:<\/strong>\r\n\r\n&nbsp;\r\n\r\nHTML code\r\n\r\n&lt;html&gt;\r\n\r\n&lt;body&gt;\r\n\r\nHello\r\n\r\n&lt;\/body&gt;\r\n\r\n&lt;\/html&gt;\r\n\r\nEncoded HTML\r\n\r\n&amp;lt;html&amp;gt;\r\n\r\n&amp;lt;body&amp;gt;\r\n\r\n&nbsp;\r\n\r\nHello\r\n\r\n&amp;lt;\/body&amp;gt;\r\n\r\n&amp;lt;\/html&amp;gt\r\n<ul>\r\n \t<li>When text is encoded , HTML code is not protected , that would make code difficult to understand who attempt to view them while passing.<\/li>\r\n<\/ul>\r\n<strong>Use innerText property:<\/strong>\r\n<ul>\r\n \t<li>Use innerText property instead of innerHTML.<\/li>\r\n \t<li>innerText property renders content safe and unexecutable.<\/li>\r\n \t<li>innerHTML is used to to programmatically modify the contents within the opening and closing tags of an HTML server control and InnerText property automatically encodes special characters to and from HTML entities.<\/li>\r\n<\/ul>\r\nfor eg. \"&lt;b&gt;My Text&lt;\/b&gt;\" starting (&lt;) and closing tag (&gt;) will not be recognized by browser if innerHTML is used but in case of innerText it will be encoded &amp;lt; &amp;gt; respectively and then decoded by browser later on at the time of display.\r\n\r\n&nbsp;\r\n\r\n<strong>Client level countermeasures against XSS:<\/strong>\r\n<ul>\r\n \t<li>Educate UsersEducate for threat<span style=\"text-align: initial;font-size: 1em\"> of XSS.\u00a0<\/span>View web content only from sources they trust.<\/li>\r\n \t<li>Implement browser security\u00a0 Disable the use of JavaScript or Active scripting for untrusted zones such as<\/li>\r\n<\/ul>\r\n<strong>2) <\/strong><strong>Unpatched Web Browser Attacks:<\/strong>\r\n<ul>\r\n \t<li>Attackers could modify Web responses with man-in-the middle attack.<\/li>\r\n \t<li>Attackers lure users to URLs where they can exploit weaknesses in things like ActiveX controls.<\/li>\r\n \t<li>Patching desktop software like web browsers should meet security requirements.<\/li>\r\n \t<li>Check whether automatically patched or should manually patched.<\/li>\r\n<\/ul>\r\n<strong>Server level Threats:<\/strong>\r\n<ul>\r\n \t<li>Web servers are much easier to reach than other servers.<\/li>\r\n \t<li>The targets are numerous - more web servers than databases and remote access servers.<\/li>\r\n \t<li>Web servers are often easier to attack.- can be accessed without authentication.<\/li>\r\n \t<li>Attacker seek notoriety<\/li>\r\n \t<li>Compromising websites creates public embarrassment and financial loss. - disgruntled ex-employees do this so the company has financial losses.<\/li>\r\n<\/ul>\r\n<strong>Common web server threats<\/strong>\r\n\r\n1) Repudiation\r\n\r\n2) Information disclosure\r\n\r\n3) Elevation of privileges\r\n\r\n4) Denial of service\r\n\r\n&nbsp;\r\n\r\n1) Repudiation:\r\n<ul>\r\n \t<li>If web server gets compromised or attacked by a denial of service(DoS), It is necessary to determine how the attacker intruded.Solution is\u2026Log all the activities.How can you check logging is enabledRepudiation Property page for Default web site. Run-&gt;inetmgr, check web server properties.<img class=\"alignnone size-full wp-image-136\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-81.png\" alt=\"\" width=\"1280\" height=\"714\" \/><\/li>\r\n<\/ul>\r\nTo verify that logging is enabled for a browser check the following\u2026.\r\n\r\n&nbsp;\r\n<ol>\r\n \t<li>Access your organization\u2019s web site and request a resource. The resource doesn\u2019t have to be valid, but should be unique so that log can be examined later on. For example, <a href=\"http:\/\/testsite\/TestHome\/IAmTestingToSeeLoggingIsEnabled.html\">http:\/\/Testsite\/TestHome\/IAmTestingToSeeLoggingIsEnabled.html<\/a><\/li>\r\n \t<li>Check for the log file. Search for files with .log extension. Open Web server\u2019s log file to make sure that the request for <a href=\"http:\/\/testsite\/TestHome\/IAmTestingToSeeLoggingIsEnabled.html\">IAmTestingToSeeLoggingIsEnabled.html<\/a> was recorded.<\/li>\r\n<\/ol>\r\n<img class=\"size-full wp-image-137 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-82.png\" alt=\"\" width=\"1280\" height=\"715\" \/>\r\n\r\n&nbsp;\r\n\r\n<img class=\"size-full wp-image-138 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-83.png\" alt=\"\" width=\"1280\" height=\"998\" \/>\r\n\r\n&nbsp;\r\n\r\n<strong>2 ) Information Disclosure:<\/strong>\r\n<ul>\r\n \t<li>Server header exposure<\/li>\r\n \t<li>Directory browsing<\/li>\r\n<\/ul>\r\nServer Header Exposure\r\n\r\ntelnet <a href=\"http:\/\/www.ldce.edu\/\">www.ldce.edu <\/a>80\r\n\r\nHEAD \/HTTP\/1.0\r\n\r\n&nbsp;\r\n\r\n<img class=\"size-full wp-image-139 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-84.png\" alt=\"\" width=\"669\" height=\"338\" \/>\r\n\r\n<strong>Directory Browsing<\/strong>\r\n\r\n&nbsp;\r\n\r\nWhen no default document such as Default.htm is found, this feature allows visiting users to view a server generated list of the contents on a website or in a virtual directory.\r\n\r\nSo server is saying..\r\n\r\nI could not find the document choose from the list.\r\n\r\nRun -&gt; inetmgr,Default web site-&gt;right click properties, go to home directory tab-&gt; directory browsing\r\n\r\n&nbsp;\r\n\r\n<img class=\"size-full wp-image-140 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-85.png\" alt=\"\" width=\"1281\" height=\"722\" \/>\r\n\r\n&nbsp;\r\n\r\nThis has potential to be abused why\u2026\r\n<ul>\r\n \t<li>If organization stored on website or in virtual directory sensitive files such as user names and password, directory browsing would give attackers immediate access to these files.<\/li>\r\n \t<li>Even if the file name is difficult to guess, like<\/li>\r\n<\/ul>\r\nNHccbxAIA1PLAR0_uMmPZV7c.txt, directory browsing could be used to access it.\r\n\r\n&nbsp;\r\n\r\n<strong>Countermeasure(Directory Browsing)\u00a0<\/strong>Open IIS manager\r\n<ul>\r\n \t<li>Open the properties page of the website or directory you want to disable directory browsing on.<\/li>\r\n \t<li>On Directory tab,verify that Directory Browsing is not selected,and then click to apply the settings Verify that directory browsing is disabled.<\/li>\r\n \t<li>Using a web browser,load the web site or virtual directory just protected. Directory browsing of the TestHome directory was disabled, so navigate to <a href=\"http:\/\/testsite\/TestHome\">http:\/\/TestSite\/TestHome <\/a>directory.<\/li>\r\n \t<li>Examine the response from server.<\/li>\r\n \t<li>If directory browsing is correctly disabled, either a message is displayed saying directory browsing is not allowed or you get other error message.<\/li>\r\n<\/ul>\r\n&nbsp;\r\n\r\n<strong>3) <\/strong><strong>Elevation of Privileges:<\/strong>Common Sources\r\n<ul>\r\n \t<li>Unpatched Web servers - Web servers are installed in hostile environments, web servers need to be sufficiently patched.Countermeasures 1.<\/li>\r\n \t<li>Use devices such as application firewalls, network firewalls or intrusion prevention systems to sanitize malicious network traffic or block it from reaching those web servers\u2026\u2026\u2026\u2026.not enough because<span style=\"text-align: initial;font-size: 1em\"> web servers\u00a0\u00a0<\/span>are still vulnerable until those missing patches are applied.\u00a0Attacker<span style=\"text-align: initial;font-size: 1em\"> is able to find another route to your organization\u2019s web servers or cause one of these protective devices to fail, web servers can be easily picked up.\u00a0<\/span>Countermeasures\u00a0\u00a0\u00a0 2.<\/li>\r\n \t<li>Apply the missing patches.<\/li>\r\n \t<li>For IIS, use automated tools like Microsoft Baseline Security Analyzer(MBSA) Verify that those patches are properly installed<\/li>\r\n<\/ul>\r\n<strong>Manual Verification<\/strong>\r\n<ol>\r\n \t<li><strong>Review the list of patches installed on a system.<\/strong><\/li>\r\n<\/ol>\r\n<p style=\"text-align: justify\">In Windows OS, click control panel,Add or remove Programs, and change or Remove programs and then review the list of installed patches under the currently installed program section.<\/p>\r\n\r\n<ol start=\"2\">\r\n \t<li><strong>Review the file versions of the affected files addressed by the patch.<\/strong><\/li>\r\n<\/ol>\r\n<p style=\"text-align: justify\">File version information about fixed DLL file was included in the bulletin so customers can verify that installed file Fp4awel.dll version 4.0.2.7802<\/p>\r\n\u00a0Verification with automated security assessment tools\r\n<ul>\r\n \t<li>Use tools such as MBSA or Nessus<\/li>\r\n \t<li>Rescan your server to make sure that no vulnerabilities are introduced or miss any patch you weren\u2019t aware of.<\/li>\r\n<\/ul>\r\nVerification with exploit code\r\n<ul>\r\n \t<li>To get defenses against the attacker, Use same tools and techniques that attacker is using.<\/li>\r\n \t<li>For patch verification thoroughly test the exploit code against test machine in isolated environment<\/li>\r\n \t<li>Unknown vulnerabilities<\/li>\r\n \t<li>Zero day vulnerabilities<\/li>\r\n<\/ul>\r\nUnknown vulnerabilities or vulnerabilities not publicly disclosed.\r\n\r\n&nbsp;\r\n<ul>\r\n \t<li>Buffer Overrun\u00a0 Stack and heap\u2026hold more data than their buffers.\u00a0 11 bytes and copy Hello World Now copy Welcome to planet Earth\u2026 What would happen?<\/li>\r\n \t<li>Buffer would store more 12 characters than it can store.<\/li>\r\n \t<li>What does buffer overrun do?<\/li>\r\n \t<li>DOS condition, making page unavailable for a period of time.(Either server recovers by itself or the administrator has to restart it)<\/li>\r\n \t<li>The attacker inject arbitrary code onto your web server and potentially gain further access to your organization.<\/li>\r\n<\/ul>\r\n<strong>Countermeasures:<\/strong>\r\n<ul>\r\n \t<li>Disable unused services<\/li>\r\n \t<li>Validate input - validate type and length on all data.<\/li>\r\n \t<li>Use application filters - such as URLScan, or use application firewalls to limit the size of HTTP requests sent by user.<\/li>\r\n \t<li>Run URLScan - goto URLScan.ini<\/li>\r\n<\/ul>\r\n<strong>Check<\/strong>\r\n<ul>\r\n \t<li>MaxURL- default 260 bytes. Check http:\/\/TestSite\/[Ax800]<\/li>\r\n \t<li>MaxQueryString - default 2048 bytes. Check http:\/\/TestSite\/index.html?foo=[Ax3000]<\/li>\r\n \t<li>Max-header prefix-restrict to 10 bytes Telnet <a href=\"http:\/\/www.ldce.edu\/\">www.ldce.edu <\/a>80 HEAD \/HTTP\/1.0 CustomHeader:[Ax30]<\/li>\r\n \t<li>MaxAllowedContentLength -default 30000000. Set it to 500.<\/li>\r\n<\/ul>\r\nTelnet <a href=\"http:\/\/www.ldce.edu\/\">www.ldce.edu <\/a>80\u00a0 HEAD \/HTTP\/1.0\u00a0 Content-Length:[Ax90000]\r\n<ul>\r\n \t<li>Nonessential services<\/li>\r\n \t<li>Best defense - Reduce the number of available services attackers can leverage.<\/li>\r\n \t<li>Organization needs only static HTML - Don\u2019t allow ASP or PHP.<\/li>\r\n \t<li>Two types of services can be exploited.<\/li>\r\n<\/ul>\r\n<ol>\r\n \t<li>Operating system - To know the services running on your web serversc.exe \\\\&lt;servername&gt; queryex | findstr \u201cSERVICE_NAME\u201d<\/li>\r\n<\/ol>\r\nTRY:sc.exe \\\\localhost queryex\r\n\r\nSERVICE_NAME: Spooler\r\n\r\nDISPLAY_NAME: Print Spooler\r\n<div>\r\n\r\nTYPE\r\n\r\n: 110 WIN32_OWN_PROCESS\r\n\r\n<\/div>\r\n<div>\r\n\r\n(interactive)\r\n\r\n<\/div>\r\n<div>\r\n\r\nSTATE\r\n\r\n: 4 RUNNING\r\n\r\n(STOPPABLE, NOT_PAUSABLE,\u00a0\u00a0<span style=\"text-align: initial;font-size: 1em\">IGNORES_SHUTDOWN)<\/span>\r\n\r\n<\/div>\r\n<div>\r\n\r\nWIN32_EXIT_CODE\u00a0\u00a0 : 0 (0x0)\r\n\r\nSERVICE_EXIT_CODE : 0 (0x0)\r\n\r\nCHECKPOINT\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 0x0\r\n\r\nWAIT_HINT\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 0x0\r\n\r\nPID\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 1620\r\n\r\nFLAGS\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :\r\n\r\n<\/div>\r\n<div>\r\n\r\nTYPE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 20 WIN32_SHARE_PROCESS\r\n\r\nSTATE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 4 RUNNING\r\n\r\n(STOPPABLE, NOT_PAUSABLE,\r\n\r\n<\/div>\r\nACCEPTS_SHUTDOWN)\r\n\r\nWIN32_EXIT_CODE\u00a0\u00a0 : 0 (0x0)\r\n\r\nSERVICE_EXIT_CODE : 0 (0x0)\r\n\r\nCHECKPOINT\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 0x0\r\n\r\nWAIT_HINT\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 0x0\r\n\r\nPID\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 2808\r\n\r\nFLAGS\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :\r\n\r\nTRY:sc.exe \\\\localhost queryex|findstr \"wudfsvc\u201c\r\n\r\nSERVICE_NAME: wudfsvc\r\n\r\n&nbsp;\r\n\r\n<strong>Countermeasures:<\/strong>\r\n<ul>\r\n \t<li>Service that is not required should be disabled.<\/li>\r\n \t<li>Disable services by going to services tab in control panel.<\/li>\r\n \t<li>Or use command<\/li>\r\n<\/ul>\r\nsc.exe \\\\&lt;servername&gt; stop\r\n\r\n&lt;servicename&gt;\r\n\r\nsc.exe <a href=\"\/\/www.ldce.edu\/\">\\\\www.ldce.edu <\/a>stop messenger\r\n\r\nTo disable that service from automatically starting when the operating system boots up, run\r\n\r\nSc.exe \\\\&lt;servername&gt; config &lt;service-name&gt;start=disabled\r\n\r\nSc.exe <a href=\"\/\/www.ldce.edu\/\">\\\\www.ldce.edu <\/a>config Messenger start= disabled\r\n<ol start=\"2\">\r\n \t<li>Web server services - Inspect web server\u2019s configuration file<\/li>\r\n<\/ol>\r\nCountermeasures:\r\n\r\n&nbsp;\r\n<ul>\r\n \t<li>Open the IIS manager.<\/li>\r\n \t<li>View the Web service Extension folder<\/li>\r\n \t<li>Prohibit extension not required -allow aasp not .ashx<\/li>\r\n \t<li>Open IIS manager<\/li>\r\n \t<li>Open properties page of website you are protecting.<\/li>\r\n \t<li>Open Home Directory tab<\/li>\r\n \t<li>On Application Configuration page, click remove for any application extensions mappings your organization does not require.<\/li>\r\n \t<li>Canonicalization attacks<\/li>\r\n \t<li><a href=\"http:\/\/testsite\/cmd.exe\">http:\/\/TestSite\/cmd%252eexe <\/a>is equivalent to<\/li>\r\n \t<li><a href=\"http:\/\/testsite\/cmd.exe\">http:\/\/TestSite\/cmd.exe<\/a><\/li>\r\n \t<li>%252e double decodes to .<\/li>\r\n \t<li>If security is on noncanonicalized forms of input data attackers might be able to bypass some security feature.<\/li>\r\n \t<li><\/li>\r\n<\/ul>\r\n<strong>Service Level Threats:<\/strong>\r\n<ul>\r\n \t<li>What is SOAP?<\/li>\r\n \t<li>Unauthorized Access<\/li>\r\n \t<li>Network Sniffing<\/li>\r\n \t<li>Tampering Information disclosure<\/li>\r\n<\/ul>\r\n&nbsp;\r\n<table>\r\n<tbody>\r\n<tr>\r\n<td><strong>you can view video on Web threats<\/strong><\/td>\r\n<td><a href=\"https:\/\/youtu.be\/03onEk4lTGc\" target=\"_blank\" rel=\"noopener\"><img class=\"alignnone wp-image-120\" src=\"http:\/\/epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/2018\/11\/download.png\" alt=\"\" width=\"36\" height=\"36\" \/><\/a><\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n\r\n<strong>Suggested Reading:<\/strong>\r\n\r\n&nbsp;\r\n<ol>\r\n \t<li>Cryptography and Network Security Principles and Practice by William Stallings, sixth Edition, PEARSON.<\/li>\r\n \t<li>Security in Computing by Charles Pfleeger &amp; Shari Lawrence Pfleeger, fourth Edition, PEARSON.<\/li>\r\n \t<li>Network Security by Charlie Kaufman, Radia Perlman, Mike Speciner, second Edition, PHI.<\/li>\r\n \t<li>The Complete Reference \u2013 Network Security by Roberta Bragg, Mark Rhodes-Ousley &amp; Keith Strassberg, Tata McGraw Hill<\/li>\r\n \t<li>Network Security Bible by Eric Cole, Ronald Krutz, James Conley, Wiley<\/li>\r\n \t<li>Hacking 6 Exposed by Stuart McClure, Joel Scambray &amp; George Kurtz , Tata McGraw Hill .<\/li>\r\n \t<li><a href=\"http:\/\/www.snort.org\/\">www.snort.org<\/a><\/li>\r\n \t<li><a style=\"text-align: initial;font-size: 1em\" href=\"https:\/\/nmap.org\/\">https:\/\/nmap.org<\/a><\/li>\r\n<\/ol>","rendered":"<div><span style=\"float: right;\"><a href=\"https:\/\/youtu.be\/03onEk4lTGc\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" src=\"http:\/\/epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/2018\/11\/download.png\" alt=\"epgp books\" width=\"75px\" height=\"75px;\" \/><\/a><br \/>\n<\/span><\/div>\n<p><strong>Client Level Threats:<\/strong><\/p>\n<ul>\n<li>1) Cross site scripting attacks<\/li>\n<li>2) Unpatched Web clients<\/li>\n<\/ul>\n<p><strong>1) <\/strong><strong>Cross \u2013Site Scripting Attacks:\u00a0<\/strong>Attacker needs to<\/p>\n<ul>\n<li>Inject HTML data into Web content<\/li>\n<li>Trick the user into visiting the XSS vulnerable website<\/li>\n<li>Cause the injected HTML data to execute on that user\u2019s browser<\/li>\n<\/ul>\n<p>Open Notepad, type following and store in server directory as test.jsp.<\/p>\n<p>&nbsp;<\/p>\n<p>&lt;html&gt;<\/p>\n<p>&lt;body&gt;<\/p>\n<p>Hello<\/p>\n<p>&lt;%<\/p>\n<p>out.println(&#8220;welcome&#8221;+request.getParameter(&#8220;name&#8221;) );<\/p>\n<p>%&gt;<\/p>\n<p>Ahmedabad<\/p>\n<p>&lt;\/body&gt;<\/p>\n<p>&lt;\/html&gt;<\/p>\n<p>&nbsp;<\/p>\n<p>Try the following &#8211; <a href=\"http:\/\/localhost:8080\/css\/test.jsp?name=LDCE\">http:\/\/localhost:8080\/css\/test.jsp?name=LDCE<\/a><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-133 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-78.png\" alt=\"\" width=\"478\" height=\"555\" srcset=\"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-78.png 478w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-78-258x300.png 258w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-78-65x75.png 65w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-78-225x261.png 225w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-78-350x406.png 350w\" sizes=\"auto, (max-width: 478px) 100vw, 478px\" \/><\/p>\n<p><strong>Observation:<\/strong><\/p>\n<ul>\n<li>1) <a href=\"http:\/\/localhost:8080\/css\/test.jsp?name=LDCE\">http:\/\/localhost:8080\/css\/test.jsp?name=LDCE<\/a><\/li>\n<li>2) http:\/\/localhost:8080\/css\/test.jsp?name=&lt;script&gt;alert(&#8220;hello&#8221;)&lt;\/script&gt; In the second case script code gets executed.<\/li>\n<\/ul>\n<p><strong>Countermeasures at Web application level:<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p><strong>Educate developers<\/strong><\/p>\n<p>Sanitize and validate all inputs that could potentially be used as part of dynamically generated Web responses.<\/p>\n<ul>\n<li><strong>Encode URL<\/strong><\/li>\n<li>URL encoding is normally performed to convert data passed via html forms, because such data may contain special character, such as &#8220;\/&#8221;, &#8220;.&#8221;, &#8220;#&#8221;, and so on, which could either:<\/li>\n<\/ul>\n<ol>\n<li>a) have special meanings;<\/li>\n<li>or b) is not a valid character for an URL;<\/li>\n<li>or c) could be altered during transfer.<\/li>\n<\/ol>\n<ul>\n<li>the &#8220;#&#8221; character has a special meaning so needs to be encoded.<\/li>\n<li>The &lt;space&gt; character also needs to be encoded because is not allowed on a valid URL format.<\/li>\n<li>Some characters, such as &#8220;~&#8221; might not transport properly across the internet.<\/li>\n<\/ul>\n<p><strong>Example<\/strong><\/p>\n<ul>\n<li>URL Encoding is visible when dealing with &lt;form&gt;s.<\/li>\n<li>Form methods (GET and POST) perform URL Encoding implicitly.<\/li>\n<li>Websites uses GET and POST methods to pass parameters between html pages.<\/li>\n<li>&lt;input type=&#8221;text&#8221; name=&#8221;var&#8221; size=&#8221;50&#8243; value=&#8221;This is a simple &amp; short test.&#8221;&gt;\n<ul>\n<li>&lt;form method=&#8221;GET&#8221; action=&#8221;example.html&#8221;&gt;<\/li>\n<\/ul>\n<\/li>\n<li>&lt;input type=&#8221;submit&#8221;&gt;\n<ul>\n<li>&lt;\/form&gt;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-135 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-80.png\" alt=\"\" width=\"514\" height=\"160\" srcset=\"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-80.png 514w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-80-300x93.png 300w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-80-65x20.png 65w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-80-225x70.png 225w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-80-350x109.png 350w\" sizes=\"auto, (max-width: 514px) 100vw, 514px\" \/><\/p>\n<ul>\n<li>This sample &lt;form&gt; sends the data in the text field using the GET method, which means that the data will be appended as query string.<\/li>\n<li>If the button is clicked and the resulting URL in the browser address bar, automatically encoded by the browser:<\/li>\n<li><a href=\"http:\/\/www.permadi.com\/tutorial\/urlEncoding\/example.html?var=This+is+a+simple+%26+short+test\">http:\/\/www.permadi.com\/tutorial\/urlEncoding\/example.html?var=This+is+a<\/a> <a href=\"http:\/\/www.permadi.com\/tutorial\/urlEncoding\/example.html?var=This+is+a+simple+%26+short+test\">+simple+%26+short+test.<\/a><\/li>\n<li>The <strong>&lt;space&gt;<\/strong> character has been URL encoded as &#8220;+&#8221;.<\/li>\n<li>The <strong>&amp;<\/strong> character has been URL encoded as &#8220;%26&#8221;.<\/li>\n<\/ul>\n<p><strong>HTML Encoding:<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>HTML code<\/p>\n<p>&lt;html&gt;<\/p>\n<p>&lt;body&gt;<\/p>\n<p>Hello<\/p>\n<p>&lt;\/body&gt;<\/p>\n<p>&lt;\/html&gt;<\/p>\n<p>Encoded HTML<\/p>\n<p>&amp;lt;html&amp;gt;<\/p>\n<p>&amp;lt;body&amp;gt;<\/p>\n<p>&nbsp;<\/p>\n<p>Hello<\/p>\n<p>&amp;lt;\/body&amp;gt;<\/p>\n<p>&amp;lt;\/html&amp;gt<\/p>\n<ul>\n<li>When text is encoded , HTML code is not protected , that would make code difficult to understand who attempt to view them while passing.<\/li>\n<\/ul>\n<p><strong>Use innerText property:<\/strong><\/p>\n<ul>\n<li>Use innerText property instead of innerHTML.<\/li>\n<li>innerText property renders content safe and unexecutable.<\/li>\n<li>innerHTML is used to to programmatically modify the contents within the opening and closing tags of an HTML server control and InnerText property automatically encodes special characters to and from HTML entities.<\/li>\n<\/ul>\n<p>for eg. &#8220;&lt;b&gt;My Text&lt;\/b&gt;&#8221; starting (&lt;) and closing tag (&gt;) will not be recognized by browser if innerHTML is used but in case of innerText it will be encoded &amp;lt; &amp;gt; respectively and then decoded by browser later on at the time of display.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Client level countermeasures against XSS:<\/strong><\/p>\n<ul>\n<li>Educate UsersEducate for threat<span style=\"text-align: initial;font-size: 1em\"> of XSS.\u00a0<\/span>View web content only from sources they trust.<\/li>\n<li>Implement browser security\u00a0 Disable the use of JavaScript or Active scripting for untrusted zones such as<\/li>\n<\/ul>\n<p><strong>2) <\/strong><strong>Unpatched Web Browser Attacks:<\/strong><\/p>\n<ul>\n<li>Attackers could modify Web responses with man-in-the middle attack.<\/li>\n<li>Attackers lure users to URLs where they can exploit weaknesses in things like ActiveX controls.<\/li>\n<li>Patching desktop software like web browsers should meet security requirements.<\/li>\n<li>Check whether automatically patched or should manually patched.<\/li>\n<\/ul>\n<p><strong>Server level Threats:<\/strong><\/p>\n<ul>\n<li>Web servers are much easier to reach than other servers.<\/li>\n<li>The targets are numerous &#8211; more web servers than databases and remote access servers.<\/li>\n<li>Web servers are often easier to attack.- can be accessed without authentication.<\/li>\n<li>Attacker seek notoriety<\/li>\n<li>Compromising websites creates public embarrassment and financial loss. &#8211; disgruntled ex-employees do this so the company has financial losses.<\/li>\n<\/ul>\n<p><strong>Common web server threats<\/strong><\/p>\n<p>1) Repudiation<\/p>\n<p>2) Information disclosure<\/p>\n<p>3) Elevation of privileges<\/p>\n<p>4) Denial of service<\/p>\n<p>&nbsp;<\/p>\n<p>1) Repudiation:<\/p>\n<ul>\n<li>If web server gets compromised or attacked by a denial of service(DoS), It is necessary to determine how the attacker intruded.Solution is\u2026Log all the activities.How can you check logging is enabledRepudiation Property page for Default web site. Run-&gt;inetmgr, check web server properties.<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-136\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-81.png\" alt=\"\" width=\"1280\" height=\"714\" srcset=\"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-81.png 1280w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-81-300x167.png 300w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-81-768x428.png 768w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-81-1024x571.png 1024w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-81-65x36.png 65w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-81-225x126.png 225w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-81-350x195.png 350w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><\/li>\n<\/ul>\n<p>To verify that logging is enabled for a browser check the following\u2026.<\/p>\n<p>&nbsp;<\/p>\n<ol>\n<li>Access your organization\u2019s web site and request a resource. The resource doesn\u2019t have to be valid, but should be unique so that log can be examined later on. For example, <a href=\"http:\/\/testsite\/TestHome\/IAmTestingToSeeLoggingIsEnabled.html\">http:\/\/Testsite\/TestHome\/IAmTestingToSeeLoggingIsEnabled.html<\/a><\/li>\n<li>Check for the log file. Search for files with .log extension. Open Web server\u2019s log file to make sure that the request for <a href=\"http:\/\/testsite\/TestHome\/IAmTestingToSeeLoggingIsEnabled.html\">IAmTestingToSeeLoggingIsEnabled.html<\/a> was recorded.<\/li>\n<\/ol>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-137 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-82.png\" alt=\"\" width=\"1280\" height=\"715\" srcset=\"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-82.png 1280w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-82-300x168.png 300w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-82-768x429.png 768w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-82-1024x572.png 1024w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-82-65x36.png 65w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-82-225x126.png 225w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-82-350x196.png 350w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-138 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-83.png\" alt=\"\" width=\"1280\" height=\"998\" srcset=\"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-83.png 1280w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-83-300x234.png 300w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-83-768x599.png 768w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-83-1024x798.png 1024w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-83-65x51.png 65w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-83-225x175.png 225w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-83-350x273.png 350w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><strong>2 ) Information Disclosure:<\/strong><\/p>\n<ul>\n<li>Server header exposure<\/li>\n<li>Directory browsing<\/li>\n<\/ul>\n<p>Server Header Exposure<\/p>\n<p>telnet <a href=\"http:\/\/www.ldce.edu\/\">www.ldce.edu <\/a>80<\/p>\n<p>HEAD \/HTTP\/1.0<\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-139 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-84.png\" alt=\"\" width=\"669\" height=\"338\" srcset=\"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-84.png 669w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-84-300x152.png 300w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-84-65x33.png 65w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-84-225x114.png 225w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-84-350x177.png 350w\" sizes=\"auto, (max-width: 669px) 100vw, 669px\" \/><\/p>\n<p><strong>Directory Browsing<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>When no default document such as Default.htm is found, this feature allows visiting users to view a server generated list of the contents on a website or in a virtual directory.<\/p>\n<p>So server is saying..<\/p>\n<p>I could not find the document choose from the list.<\/p>\n<p>Run -&gt; inetmgr,Default web site-&gt;right click properties, go to home directory tab-&gt; directory browsing<\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-140 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-85.png\" alt=\"\" width=\"1281\" height=\"722\" srcset=\"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-85.png 1281w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-85-300x169.png 300w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-85-768x433.png 768w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-85-1024x577.png 1024w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-85-65x37.png 65w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-85-225x127.png 225w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-85-350x197.png 350w\" sizes=\"auto, (max-width: 1281px) 100vw, 1281px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>This has potential to be abused why\u2026<\/p>\n<ul>\n<li>If organization stored on website or in virtual directory sensitive files such as user names and password, directory browsing would give attackers immediate access to these files.<\/li>\n<li>Even if the file name is difficult to guess, like<\/li>\n<\/ul>\n<p>NHccbxAIA1PLAR0_uMmPZV7c.txt, directory browsing could be used to access it.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Countermeasure(Directory Browsing)\u00a0<\/strong>Open IIS manager<\/p>\n<ul>\n<li>Open the properties page of the website or directory you want to disable directory browsing on.<\/li>\n<li>On Directory tab,verify that Directory Browsing is not selected,and then click to apply the settings Verify that directory browsing is disabled.<\/li>\n<li>Using a web browser,load the web site or virtual directory just protected. Directory browsing of the TestHome directory was disabled, so navigate to <a href=\"http:\/\/testsite\/TestHome\">http:\/\/TestSite\/TestHome <\/a>directory.<\/li>\n<li>Examine the response from server.<\/li>\n<li>If directory browsing is correctly disabled, either a message is displayed saying directory browsing is not allowed or you get other error message.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><strong>3) <\/strong><strong>Elevation of Privileges:<\/strong>Common Sources<\/p>\n<ul>\n<li>Unpatched Web servers &#8211; Web servers are installed in hostile environments, web servers need to be sufficiently patched.Countermeasures 1.<\/li>\n<li>Use devices such as application firewalls, network firewalls or intrusion prevention systems to sanitize malicious network traffic or block it from reaching those web servers\u2026\u2026\u2026\u2026.not enough because<span style=\"text-align: initial;font-size: 1em\"> web servers\u00a0\u00a0<\/span>are still vulnerable until those missing patches are applied.\u00a0Attacker<span style=\"text-align: initial;font-size: 1em\"> is able to find another route to your organization\u2019s web servers or cause one of these protective devices to fail, web servers can be easily picked up.\u00a0<\/span>Countermeasures\u00a0\u00a0\u00a0 2.<\/li>\n<li>Apply the missing patches.<\/li>\n<li>For IIS, use automated tools like Microsoft Baseline Security Analyzer(MBSA) Verify that those patches are properly installed<\/li>\n<\/ul>\n<p><strong>Manual Verification<\/strong><\/p>\n<ol>\n<li><strong>Review the list of patches installed on a system.<\/strong><\/li>\n<\/ol>\n<p style=\"text-align: justify\">In Windows OS, click control panel,Add or remove Programs, and change or Remove programs and then review the list of installed patches under the currently installed program section.<\/p>\n<ol start=\"2\">\n<li><strong>Review the file versions of the affected files addressed by the patch.<\/strong><\/li>\n<\/ol>\n<p style=\"text-align: justify\">File version information about fixed DLL file was included in the bulletin so customers can verify that installed file Fp4awel.dll version 4.0.2.7802<\/p>\n<p>\u00a0Verification with automated security assessment tools<\/p>\n<ul>\n<li>Use tools such as MBSA or Nessus<\/li>\n<li>Rescan your server to make sure that no vulnerabilities are introduced or miss any patch you weren\u2019t aware of.<\/li>\n<\/ul>\n<p>Verification with exploit code<\/p>\n<ul>\n<li>To get defenses against the attacker, Use same tools and techniques that attacker is using.<\/li>\n<li>For patch verification thoroughly test the exploit code against test machine in isolated environment<\/li>\n<li>Unknown vulnerabilities<\/li>\n<li>Zero day vulnerabilities<\/li>\n<\/ul>\n<p>Unknown vulnerabilities or vulnerabilities not publicly disclosed.<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>Buffer Overrun\u00a0 Stack and heap\u2026hold more data than their buffers.\u00a0 11 bytes and copy Hello World Now copy Welcome to planet Earth\u2026 What would happen?<\/li>\n<li>Buffer would store more 12 characters than it can store.<\/li>\n<li>What does buffer overrun do?<\/li>\n<li>DOS condition, making page unavailable for a period of time.(Either server recovers by itself or the administrator has to restart it)<\/li>\n<li>The attacker inject arbitrary code onto your web server and potentially gain further access to your organization.<\/li>\n<\/ul>\n<p><strong>Countermeasures:<\/strong><\/p>\n<ul>\n<li>Disable unused services<\/li>\n<li>Validate input &#8211; validate type and length on all data.<\/li>\n<li>Use application filters &#8211; such as URLScan, or use application firewalls to limit the size of HTTP requests sent by user.<\/li>\n<li>Run URLScan &#8211; goto URLScan.ini<\/li>\n<\/ul>\n<p><strong>Check<\/strong><\/p>\n<ul>\n<li>MaxURL- default 260 bytes. Check http:\/\/TestSite\/[Ax800]<\/li>\n<li>MaxQueryString &#8211; default 2048 bytes. Check http:\/\/TestSite\/index.html?foo=[Ax3000]<\/li>\n<li>Max-header prefix-restrict to 10 bytes Telnet <a href=\"http:\/\/www.ldce.edu\/\">www.ldce.edu <\/a>80 HEAD \/HTTP\/1.0 CustomHeader:[Ax30]<\/li>\n<li>MaxAllowedContentLength -default 30000000. Set it to 500.<\/li>\n<\/ul>\n<p>Telnet <a href=\"http:\/\/www.ldce.edu\/\">www.ldce.edu <\/a>80\u00a0 HEAD \/HTTP\/1.0\u00a0 Content-Length:[Ax90000]<\/p>\n<ul>\n<li>Nonessential services<\/li>\n<li>Best defense &#8211; Reduce the number of available services attackers can leverage.<\/li>\n<li>Organization needs only static HTML &#8211; Don\u2019t allow ASP or PHP.<\/li>\n<li>Two types of services can be exploited.<\/li>\n<\/ul>\n<ol>\n<li>Operating system &#8211; To know the services running on your web serversc.exe \\\\&lt;servername&gt; queryex | findstr \u201cSERVICE_NAME\u201d<\/li>\n<\/ol>\n<p>TRY:sc.exe \\\\localhost queryex<\/p>\n<p>SERVICE_NAME: Spooler<\/p>\n<p>DISPLAY_NAME: Print Spooler<\/p>\n<div>\n<p>TYPE<\/p>\n<p>: 110 WIN32_OWN_PROCESS<\/p>\n<\/div>\n<div>\n<p>(interactive)<\/p>\n<\/div>\n<div>\n<p>STATE<\/p>\n<p>: 4 RUNNING<\/p>\n<p>(STOPPABLE, NOT_PAUSABLE,\u00a0\u00a0<span style=\"text-align: initial;font-size: 1em\">IGNORES_SHUTDOWN)<\/span><\/p>\n<\/div>\n<div>\n<p>WIN32_EXIT_CODE\u00a0\u00a0 : 0 (0x0)<\/p>\n<p>SERVICE_EXIT_CODE : 0 (0x0)<\/p>\n<p>CHECKPOINT\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 0x0<\/p>\n<p>WAIT_HINT\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 0x0<\/p>\n<p>PID\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 1620<\/p>\n<p>FLAGS\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :<\/p>\n<\/div>\n<div>\n<p>TYPE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 20 WIN32_SHARE_PROCESS<\/p>\n<p>STATE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 4 RUNNING<\/p>\n<p>(STOPPABLE, NOT_PAUSABLE,<\/p>\n<\/div>\n<p>ACCEPTS_SHUTDOWN)<\/p>\n<p>WIN32_EXIT_CODE\u00a0\u00a0 : 0 (0x0)<\/p>\n<p>SERVICE_EXIT_CODE : 0 (0x0)<\/p>\n<p>CHECKPOINT\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 0x0<\/p>\n<p>WAIT_HINT\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 0x0<\/p>\n<p>PID\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 2808<\/p>\n<p>FLAGS\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :<\/p>\n<p>TRY:sc.exe \\\\localhost queryex|findstr &#8220;wudfsvc\u201c<\/p>\n<p>SERVICE_NAME: wudfsvc<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Countermeasures:<\/strong><\/p>\n<ul>\n<li>Service that is not required should be disabled.<\/li>\n<li>Disable services by going to services tab in control panel.<\/li>\n<li>Or use command<\/li>\n<\/ul>\n<p>sc.exe \\\\&lt;servername&gt; stop<\/p>\n<p>&lt;servicename&gt;<\/p>\n<p>sc.exe <a href=\"\/\/www.ldce.edu\/\">\\\\www.ldce.edu <\/a>stop messenger<\/p>\n<p>To disable that service from automatically starting when the operating system boots up, run<\/p>\n<p>Sc.exe \\\\&lt;servername&gt; config &lt;service-name&gt;start=disabled<\/p>\n<p>Sc.exe <a href=\"\/\/www.ldce.edu\/\">\\\\www.ldce.edu <\/a>config Messenger start= disabled<\/p>\n<ol start=\"2\">\n<li>Web server services &#8211; Inspect web server\u2019s configuration file<\/li>\n<\/ol>\n<p>Countermeasures:<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>Open the IIS manager.<\/li>\n<li>View the Web service Extension folder<\/li>\n<li>Prohibit extension not required -allow aasp not .ashx<\/li>\n<li>Open IIS manager<\/li>\n<li>Open properties page of website you are protecting.<\/li>\n<li>Open Home Directory tab<\/li>\n<li>On Application Configuration page, click remove for any application extensions mappings your organization does not require.<\/li>\n<li>Canonicalization attacks<\/li>\n<li><a href=\"http:\/\/testsite\/cmd.exe\">http:\/\/TestSite\/cmd%252eexe <\/a>is equivalent to<\/li>\n<li><a href=\"http:\/\/testsite\/cmd.exe\">http:\/\/TestSite\/cmd.exe<\/a><\/li>\n<li>%252e double decodes to .<\/li>\n<li>If security is on noncanonicalized forms of input data attackers might be able to bypass some security feature.<\/li>\n<li><\/li>\n<\/ul>\n<p><strong>Service Level Threats:<\/strong><\/p>\n<ul>\n<li>What is SOAP?<\/li>\n<li>Unauthorized Access<\/li>\n<li>Network Sniffing<\/li>\n<li>Tampering Information disclosure<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>you can view video on Web threats<\/strong><\/td>\n<td><a href=\"https:\/\/youtu.be\/03onEk4lTGc\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-120\" src=\"http:\/\/epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/2018\/11\/download.png\" alt=\"\" width=\"36\" height=\"36\" \/><\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>Suggested Reading:<\/strong><\/p>\n<p>&nbsp;<\/p>\n<ol>\n<li>Cryptography and Network Security Principles and Practice by William Stallings, sixth Edition, PEARSON.<\/li>\n<li>Security in Computing by Charles Pfleeger &amp; Shari Lawrence Pfleeger, fourth Edition, PEARSON.<\/li>\n<li>Network Security by Charlie Kaufman, Radia Perlman, Mike Speciner, second Edition, PHI.<\/li>\n<li>The Complete Reference \u2013 Network Security by Roberta Bragg, Mark Rhodes-Ousley &amp; Keith Strassberg, Tata McGraw Hill<\/li>\n<li>Network Security Bible by Eric Cole, Ronald Krutz, James Conley, Wiley<\/li>\n<li>Hacking 6 Exposed by Stuart McClure, Joel Scambray &amp; George Kurtz , Tata McGraw Hill .<\/li>\n<li><a href=\"http:\/\/www.snort.org\/\">www.snort.org<\/a><\/li>\n<li><a style=\"text-align: initial;font-size: 1em\" href=\"https:\/\/nmap.org\/\">https:\/\/nmap.org<\/a><\/li>\n<\/ol>\n","protected":false},"author":4,"menu_order":14,"template":"","meta":{"pb_show_title":"on","pb_short_title":"","pb_subtitle":"","pb_authors":["miss-hiteishi-diwanji"],"pb_section_license":""},"chapter-type":[],"contributor":[58],"license":[],"class_list":["post-132","chapter","type-chapter","status-publish","hentry","contributor-miss-hiteishi-diwanji"],"part":3,"_links":{"self":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapters\/132","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapters"}],"about":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/wp\/v2\/types\/chapter"}],"author":[{"embeddable":true,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/wp\/v2\/users\/4"}],"version-history":[{"count":11,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapters\/132\/revisions"}],"predecessor-version":[{"id":450,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapters\/132\/revisions\/450"}],"part":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/parts\/3"}],"metadata":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapters\/132\/metadata\/"}],"wp:attachment":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/wp\/v2\/media?parent=132"}],"wp:term":[{"taxonomy":"chapter-type","embeddable":true,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapter-type?post=132"},{"taxonomy":"contributor","embeddable":true,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/wp\/v2\/contributor?post=132"},{"taxonomy":"license","embeddable":true,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/wp\/v2\/license?post=132"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}