Web_Application_Attacks_PTS

4.2) Web Server fingerprinting  

- Fingerprinting a web server means detecting: 
i) The daemon providing the web server service, such as IIS, Apache, Nginx and others.
ii) Its version 
iii) the Operating System hosting the web server 


- Netcat is a very powerfull tool known as the [TCP/IP Swiss army Knief]
- it can be use in many different ways, could be both a server or a client. 
*- To fingerprint a web sever you can use NetCat as a client to manually send requests to the sever and receive responses.

- The following activity is called [Banner Grabbing] 
- To grab a banner you just have to connect to a listening daemon and then read the banner it sends back to your client
> nc <destinatio host> <port No> 

HEAD request
> nc 192.168.1.1 80 
> HEAD / HTTP/1.0           \\ Hit return two times 

* IMPORTANT and COMMON MISTAKE
i) you HAVE to write the request in upper case. 
ii) Netcat doesn't notify you when connecting to the sever, you HAVE to write your request when after running the command, to change this 
behavior you COULD use the verbose (-v) command line switch
iii) Netcat doesn't perform any kind of encryption, so you CAN'T connect to an HTTPS daemon (service). So once connecting to HTTPS you'll 
see it drops after enrting your request. 

- If you want to fingerprint an server listening only to HTTPS port, you could use openSSL command line: 
> openssl s_client -connect <target_site>:443       \\ once entring you COULD use the HEAD verb 
> HEAD / HTTP/1.0

- When Performing a fingerprinting, A system Administrator CAN customize the web server banners to make the fingerprinting harder 
- Automatic tools go beyond banner grabbing, they fingerprint small-implementation-dependant details such as: 
i) Headers ordering in response messages. 
ii) Error handling. 


- HTTP is a web server fingerprinting tool, USES signature-base techniques to identify web servers. 
- The most used synatx: 
> httprint -P0 -h <target_site> -s <signatures_file>
-P0 is to aviod pinging the host, because most web sever doesn't respond to ping request 
-h to idenrify the targeted hosts. It is advised to use the IP address 
-s to set the singature files for using 

>> httprint -P0 -h 192.168.1.1 -s /usr/share/httprint/singatures.txt 

===============================================================================================================
4.3) HTTP verbs

- Most Common HTTP methods are:
GET, HEAD, POST, DELETE, and PUT. 

i) GET is used to request a resources, when a user wants to open a page, the browser sends a GET request. 
> GET /page.php HTTP/1.1
> HOST: example.com
- GET can pass an arguments to the web application: 
> GET /page.php?course=PTS HTTP/1.1
> HOST: www.exam.com

ii) POST is used to submit a HTML form date, POST parameters must be in the message body: 

> POST /login.php HTTP/1.1 
> HOST: www.site.com 
username=john&passwrod=mypass

iii) HEAD / HTTP/1.1

iv) PUT is used to upload a file to the server, it's a very dangerous feature if it's allowed or misconfigured.
> PUT /path/to/destination HTTP/1.1
> HOST: site.com

<PUT data>


V) DELETE is used to delete a file from the server, this is another feature should be configured wisely, as a misused DELETE leads to 
denial of service and data loss. 
> DELETE /path/to/destination HTTP/1.1

vi) OPTIONS is used to query the web server for enabled HTTP methods:
> OPTIONS / HTTP/1.1