1. Web Security

2. Introduction Webserver hacking refers to attackers taking advantage of vulnerabilities inherent to the web server software itself These vulnerabilities are typically publicized and are easy to detect and attack An attacker with the right set of tools and ready-made exploits can bring down a vulnerable web server in minutes For this reason, it is crucial for web administrators to always patch their webserver and related software.

3. Lab Goals Setup an Apache web server with some third-party modules Find vulnerabilities using various tools Setting up and cracking basic authentication

4. Webserver setup Apache 1.3.23 - will be installed as the web server MySQL 3.23.49 - is an open source database PHP 4.2.0 - a scripting language that is especially suited for Web development and can be embedded into HTML OpenSSL 0.9.6d - provides strong cryptography for the Apache 1.3 web server via the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) Mod_ssl 2.8.7 - patches Apache so that it uses SSL support via OpenSSL

5. Useful Tools Httpdtype – this tool will determine the version of Apache running and what additional modules are built into it. User discovery – using a bug in Apache it is possible to determine what users are on the server Nikto – a webserver scanner that performs comprehensive tests for multiple known web server vulnerabilities

6. Retrieving website content When targeting a web server a serious hacker would study its content thoroughly. This might involve downloading its entire content for offline examination Wget does the job, it works with HTTP, HTTPS, and FTP.

7. Basic Authentication Basic Authentication prevents unauthorized access to data stored in the server Two tasks will be performed:  Protect a folder using Basic Authentication  Use utility such as Brutus to crack the Basic Authentication password protecting the folder