Security
  • IT Security Knowledge Base
  • Blue team
    • Linux System Hardening
    • Phishing Analysis
    • Snort
    • Yara
  • Capture the Flag
    • OverTheWire
      • Bandit
        • Bandit Level 0
        • Bandit Level 0 → Level 1
        • Bandit Level 1 → Level 2
        • Bandit Level 2 → Level 3
        • Bandit Level 3 → Level 4
        • Bandit Level 4 → Level 5
        • Bandit Level 5 → Level 6
        • Bandit Level 6 → Level 7
        • Bandit Level 7 → Level 8
        • Bandit Level 8 → Level 9
        • Bandit Level 9 → Level 10
        • Bandit Level 10 → Level 11
        • Bandit Level 11 → Level 12
        • Bandit Level 12 → Level 13
        • Bandit Level 13 → Level 14
        • Bandit Level 14 → Level 15
        • Bandit Level 15 → Level 16
        • Bandit Level 16 → Level 17
        • Bandit Level 17 → Level 18
        • Bandit Level 18 → Level 19
        • Bandit Level 19 → Level 20
        • Bandit Level 20→ Level 21
        • Bandit Level 21→ Level 22
        • Bandit Level 22 → Level 23
        • Bandit Level 23 → Level 24
        • Bandit Level 24 → Level 25
        • Bandit Level 25 → Level 26
        • Bandit Level 26 → Level 27
        • Bandit Level 27 → Level 28
        • Bandit Level 28 → Level 29
        • Bandit Level 29 → Level 30
        • Bandit Level 30 → Level 31
        • Bandit Level 31 → Level 32
        • Bandit Level 32 → Level 33
    • OWASP Juice Shop
      • Installation
      • Level 1 - Challenges
      • Level 2 - Challenges
    • TryHackMe Rooms
      • Anthem
      • Capture!
      • Corridor
      • Gotta Catch'em All!
      • Mustacchio
      • Neighbour
      • Opacity
      • Source
    • CEH v12 practical resources
  • Cryptology
    • CryptoHack
      • Course: Introduction to CryptoHack
        • Introduction - Challenges
        • General - Encoding
        • General - XOR
      • Course: Modular Arithmetic
        • General - Mathematics
        • Mathematics - Modular Math
        • Mathematics - Brainteasers Part 1
      • Course: Symmetric Cryptography
        • How AES Works
        • Symmetric Starter
        • Block Ciphers
        • Stream Ciphers
  • Red Team
    • Reconnaissance
      • Foot-printing
      • Scanning (Nmap)
      • Enumeration
    • Vulnerability Analysis
    • Initial Access
      • Obtaining credentials
      • Vulnerability Exploitation
        • Buffer Overflow
        • Metasploit and Armitage
        • Ninja Jonin
    • Active Directory
      • Connect to AD
      • AD Explore
      • CMD and PowerShell enumeration
      • Certificates in AD
      • LDAP Pass-back Attacks
      • Cracking NetNTLM Challenge with Responder
      • Exploring Configuration Files for AD Credentials
      • Pass the hash with evil WinRM
      • Understanding Runas
    • Malware
    • Sniffing
      • Intercept HTTP traffic - Hetty
      • Intercept HTTP traffic - Bettercap
      • Wireshark
    • Social Engineering
    • Denial of Service
    • Web Hacking
      • Burp Suite
      • OWASP ZAP
      • Web servers
      • Web Server Footprinting
      • Directory Enumeration
      • Session Hijacking
      • Web Shells
      • Web vulnerability scanners
      • SQL Injection
    • Cloud
    • Wireless Networks
      • Attacking WEP
      • Attacking WPA/WPA2
    • Mobile Devices
    • Network Security Evasion
    • Privileges Escalation
    • Maintain Access and Hide Malicious Activity
      • Backdooring
    • Cover your Tracks
  • Internet of Things
    • IoT in general
    • Common IoT Protocols
      • CoAP
      • MQTT
      • ZIGBEE
      • Bluetooth
    • Scapy
      • Sniffing and spoofing
      • ARP cache Poisoning
  • Projects
    • Cybersecurity Roadshow
Powered by GitBook
On this page
  • Components of a Web Server
  • HTTP Response-Splitting Attack
  • Web Cache Poisoning Attack
  1. Red Team
  2. Web Hacking

Web servers

A web server is a computer the stores and processes web pages to a client via HTTP(S).

PreviousOWASP ZAPNextWeb Server Footprinting

Last updated 1 year ago

Components of a Web Server

  1. The Document Root is the directory on a web server where web content and files are stored. It serves as the starting point for the web server to locate and serve web pages and resources. When a user accesses a specific URL, the web server looks within the Document Root to find the corresponding files to deliver to the user's browser.

  2. The Server Root is the top-level directory on a web server where all server-related configuration files and directories are located. It often includes the server's configuration files, log files, and other system-related resources. The Server Root is distinct from the Document Root, which contains web content.

  3. The Virtual Document Tree is a concept used in web server configuration to map URLs to directories within the Document Root. It allows web administrators to create a virtual directory structure that may not necessarily correspond directly to the server's file system. This is particularly useful for creating user-friendly URLs and organizing web content.

  4. Virtual Hosting is a technique that allows a single web server to host multiple websites on the same physical server. It's achieved by configuring the server to recognize different hostnames (e.g., and ) and serve the appropriate web content based on the requested hostname. Virtual Hosting can be implemented using techniques such as Name-based Virtual Hosting and IP-based Virtual Hosting.

  5. A Web Proxy is an intermediary server that acts as a gateway between a client and a web server. It receives client requests, forwards them to the destination web server, and then returns the web server's responses to the client. Web proxies can serve various purposes, including enhancing security, improving performance, caching content, and providing anonymity for users. They are often used to filter or redirect web traffic within a network.

HTTP Response-Splitting Attack

HTTP response splitting is an attack where:

  • Untrusted data from an HTTP request enters a web application.

  • This data, if not properly validated, is included in an HTTP response header that is sent to a web user.

To succeed, the attacker must introduce malicious data into the application, which incorporates it into an HTTP response header. The application must permit input with characters like CR (carriage return) and LF (line feed) in headers.

Here's a simplified example:

Consider a code segment that reads the name of a weblog entry's author, "author," from an HTTP request and sets it in a cookie header of an HTTP response.

String author = request.getParameter(AUTHOR_PARAM);
...
Cookie cookie = new Cookie("author", author);
cookie.setMaxAge(cookieExpiration);
response.addCookie(cookie);

Assuming a string with standard alphanumeric characters, such as "Jane Smith," is submitted in the request, the HTTP response, including this cookie, would appear as follows:

HTTP/1.1 200 OK
...
Set-Cookie: author=Jane Smith
...

However, if the value of the cookie is composed of unvalidated user input, the response will only maintain this form if the submitted value for AUTHOR_PARAM does not contain CR and LF characters. If an attacker submits a malicious string, such as "Wiley Hacker\r\nContent-Length:999\r\n\r\n...", the HTTP response would be split into an imposter response followed by the original response, which is now ignored:

HTTP/1.1 200 OK
...
Set-Cookie: author=Wiley Hacker
Content-Length: 999

<html>malicious content...</html> (up to the 999th character in this example)
Original content starting with character 1000, which is now ignored by the web browser...

Note that the example provided is written in Java. However, this issue has been resolved in nearly all modern Java EE application servers.

Web Cache Poisoning Attack

Web Cache Poisoning Attack is a sophisticated exploitation technique. It involves an attacker taking advantage of a web server and cache's behavior to serve a malicious HTTP response to unsuspecting users. This attack comprises two fundamental phases:

  1. The attacker needs to figure out how to trigger a response from the back-end server that unintentionally includes a harmful payload.

  2. After succeeding in this, the attacker ensures that their response is stored in the cache and then delivered to the target victims.

A compromised web cache can serve as a potent vector for propagating a variety of attacks, capitalizing on vulnerabilities such as Cross-Site Scripting (XSS), JavaScript injection, open redirection, and more. This makes web cache poisoning a highly effective and potentially devastating attack method.

www.example1.com
www.example2.com
https://www.javatpoint.com/web-servers