Web Server Penetration Testing Checklist

Web server pen testing performing under 3 major category which is identity, Analyse, Report Vulnerabilities such as authentication weakness, configuration errors, protocol Relation vulnerabilities.

“Conduct a serial of methodical and Repeatable tests “ is the best way to test the web server along with this to work through all of the different application Vulnerabilities.

• “Collecting as Much as Information” about an organization Ranging from operation environment is the main area to concentrate with the initial stage of web server Pen testing.

• Performing web server Authentication Testing , use Social engineering techniques to collect the information about the Human Resources , contact Details and other  Social Related information.

• Gathering Information about the Target, use whois database query tools to get the Details such as Domain name, IPaddress, Administrative Details, autonomous system number, DNS etc.

• Fingerprint web server to gather information such as server name, server type, operating systems, application running on the server etc use fingerprint scanning tools such as , Netcraft, HTTPrecon , ID Serve .

• Crawel Website to gather Specific information  from web pages, such as email addresses

• Enumerate web server Directories to extract important information about web functionalities, login forms etc.

• Perform Directory traversal Attack to access Restricted Directories and execute the command from outside of the Web server root directories.

• Performing vulnerability scanning to identify the weakness in the network use the vulnerability scanning tools such as HPwebinspect, Nessus . and determine if the system can be exploited.

• Perform we cache poisoning attack to force the web server’s cache to flush its actual cache content and send a specifically crafted request which will be stored in the cache.

• Performing HTTP response splitting attack to pass malicious data to a vulnerable application that includes the data in an HTTP response header.

• Bruteforce SSH,FTP, and other services login credentials to gain unauthorized access.

• Perform session hijacking to capture valid session cookies and ID’s,use tools such as       Burb suite , Firesheep ,jhijack to automated session hijacking.

• Performing MITM attack to access the sensitive information by intercepting the altering the communications between the end users and web servers.

• Use tools such as  webalizer, AWStats to examine the web server logs .

CORE Impact pro

CORE Impact pro is the software solution for assessing  and testing the vulnerabilities in the organization’s web servers , Nerwork system’s , Endpoint systems , wireless networks , network devices ,Mobile devices ,IDS/IPS  .

Important Checklist Suggested by Microsoft

Services

• Unnecessary Windows services are disabled.
• Services are running with least-privileged accounts.
• FTP, SMTP, and NNTP services are disabled if they are not required.
• Telnet service is disabled.

Protocols

• WebDAV is disabled if not used by the application OR it is secured if it is required.
• TCP/IP stack is hardened
• NetBIOS and SMB are disabled (closes ports 137, 138, 139, and 445).

Accounts

• Unused accounts are removed from the server.
• Guest account is disabled.
• IUSR_MACHINE account is disabled if it is not used by the application.
• If your applications require anonymous access, a custom least-privileged anonymous account is created.
• The anonymous account does not have write access to Web content directories and cannot execute command-line tools.
• Strong account and password policies are enforced for the server.
• Remote logons are restricted. (The “Access this computer from the network” user-right is removed from the Everyone group.)
• Accounts are not shared among administrators.
• Null sessions (anonymous logons) are disabled.
• Approval is required for account delegation.
• Users and administrators do not share accounts.
• No more than two accounts exist in the Administrators group.
• Administrators are required to log on locally OR the remote administration solution is secure.

Files and Directories

• Files and directories are contained on NTFS volumes
• Web site content is located on a non-system NTFS volume.
• Log files are located on a non-system NTFS volume and not on the same volume where the Web site content resides.
• The Everyone group is restricted (no access to \WINNT\system32 or Web directories).
• Web site root directory has deny write ACE for anonymous Internet accounts.
• Content directories have deny write ACE for anonymous Internet accounts.
• Remote  administration application is removed
• Resource kit tools, utilities, and SDKs are removed.
• Sample applications are removed

Shares

• All unnecessary shares are removed (including default administration shares).
• Access to required shares is restricted (the Everyone group does not have access).
• Administrative shares (C$ and Admin$) are removed if they are not required (Microsoft Management Server (SMS) and Microsoft Operations Manager (MOM) require these shares).

Ports

• Internet-facing interfaces are restricted to port 80 (and 443 if SSL is used)
• Intranet traffic is encrypted (for example, with SSL) or restricted if you do not have a secure data center infrastructure.

Registry

• Remote registry access is restricted.
• SAM is secured (HKLM\System\CurrentControlSet\Control\LSA\NoLMHash).

Auditing and Logging

•  Failed logon attempts are audited.
•  IIS log files are relocated and secured.
• Log files are configured with an appropriate size depending on the application security requirement.
• Log files are regularly archived and analyzed.
• Access to the Metabase.bin file is audited.
• IIS is configured for W3C Extended log file format auditing.

Server Certificates

• Ensure certificate date ranges are valid.
• Only use certificates for their intended purpose (For example, the server certificate is not used for e-mail).
•  Ensure the certificate’s public key is valid, all the way to a trusted root authority.
• Confirm that the certificate has not been revoked.

Source