Finding Web Server Flaws
If you are lucky, the web server you are targeting may contain some of the actual vulnerabilities described in this chapter. More likely, however, it will have been patched to a more recent level, and you will need to search for something fairly current or brand new with which to attack the server.
A good starting point when looking for vulnerabilities in an off-the-shelf product like a web server is to use an automated scanning tool. Unlike web applications, which are usually custom-built, almost all web server deployments use third-party software that has been installed and configured in the same way that countless people have done before. In this situation, automated scanners can be highly effective at quickly locating low-hanging fruit, by sending huge numbers of crafted requests and monitoring for signatures indicating the presence of known vulnerabilities. Nessus is an excellent free vulnerability scanner, and there are various commercial alternatives available, such as Typhon and ISS.
In addition to running scanning tools, you should always perform your own research into the software you are attacking. Consult resources like Security Focus and the mailing lists Bugtraq and Full Disclosure to find details of any recently discovered vulnerabilities that may not have been fixed on your target.
You should be aware that some web application products include an open source web server such as Apache or Jetty as part of their installation. Security updates to these bundled servers may be applied more slowly because administrators may view the server as part of the installed application, rather than as part of the infrastructure they are responsible for. Further, standard service banners may have been modified in this situation. Performing some manual testing and research into the software may, therefore, be highly effective in identifying defects that an automated scanner may miss.
If possible, you should consider performing a local installation of the software you are attacking, and carry out your own testing to find new vulnerabilities that have not been discovered or widely circulated.
