It's always good to
know which applications are installed on a server before trying to exploit
it. Many applications already have
existing vulnerabilities and other
applications are not updated by the company for various reasons. Due to virtual web servers, many websites are
hosted under one IP address. This means that to access a certain application,
you would have to go through the DNS name rather than the numeric IP. Finding all the web applications on a web
server through whatever means is the definition of web application discovery.
Once we are given a
target (a DNS name or IP address), there are three factors that influences
finding applications that are hosted on
that target. First factor is a Different Base
URL. The base URL is the target given to us (the DNS name). So if our
target is http://google.com, the base URL is
google.com, but what if the application is hosted on http://google.com/app1/? Secondly, the use of non-standard ports. By default, people use port 80 for web
servers , however what happens if people start using random ports? Lastly, we
have the idea of virtual hosts. That is, multiple domains pointing to one IP
Address. So, how do we find solutions
for the above situations?
It's difficult to
find applications if they are installed somewhere other than the base URL. The
best way to find is through search engines (if application is on the internet)
or through intelligent guessing (for example, a mail application could be installed
in a directory called 'mail'). If an
application is ran on a non-standard port, we can easily find it through
running a port scanner like nmap.
Lastly, the best way to combat the virtual host setup would be using a reverse
IP tool such as the one provided by domaintools.com. The
reverse IP tool works by just entering an IP address and it tries to list all
the domains hosted on that IP address.
