Disable/Remove Server: Apache header info version (Apache2.4)

File Name : httpd-ssl.conf  OR ssl.conf

*************************************************************

LoadModule headers_module modules/mod_headers.so

Header unset Server

Header unset Etag

ServerTokens Prod

ServerSignature off

SecServerSignature " "

*************************************************************

OR 

Enable: modules for mod_security.

• LoadModule security2_module modules/mod_security2.so

• <IfModule !mod_unique_id.c>  LoadModule unique_id_module modules/mod_unique_id.so  </IfModule>

File Name : mod_security.conf

*************************************************************

<IfModule mod_security2.c>

    # Default recommended configuration

        SecRuleEngine On

SecServerSignature "123456 "

        SecRequestBodyAccess On

        ...

        ... ...

        ... ... ...

<IfModule mod_security2.c>

*************************************************************

Thanks 😊

Restrict application Accessible by IP Address & HTTP Host Header Injection (Apache 2.4)

• To mitigate host header poisoning/attack kindly make sure.

• Use the hostname instead of IP address in the header.

• Can refuse a request if it doesn't have the desired or expected host header. 

• For this, Add initial RewriteCond/RewriteRule pair to confirm the HOST requested is ABCDEF.com and error if not.

• To restrict add below lines between <VirtualHost :443> OR  <VirtualHost :80>  

File Name : httpd-ssl.conf  OR ssl.conf

*************************************************************

LoadModule rewrite_module modules/mod_rewrite.so

<VirtualHost *:443>

  ServerName ABCDEF.com

  ServerAlias www.ABCDEF.com

  

  ### UseCanonicalName On Apache httpd will use the hostname and port specified in the ServerName or ServerAlias

  UseCanonicalName On 

  

  ## Restrict the Use of IP adderss in URL

  SetEnvIf Host "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" HostHeaderIsIP=1

  RewriteEngine on

  RewriteCond %{ENV:HostHeaderIsIP} 1

  RewriteRule .* - [F]

  

  ## HTTP Host Header Injection

  RewriteEngine On

  RewriteCond %{HTTP_HOST} !^www.abcdef.com [NC]

  RewriteCond %{HTTP_HOST} !^(www.abcdef.com|abcdef.com)$ [NC]

  RewriteRule .* - [F]

  </VirtualHost>

  

****************************************************************

To check,  use below curl command as per your application URI:-

• curl -H "Host: www.example.com" http://localhost/

• curl -i -s -k -X $'GET' -H $'Host: wwww.example.com' $'https://www.abcdef.com/app/web/acess'

Thanks 😊

HTTP Host Header Injection (Apache and IBM HTTP SERVER- IHS)

• To mitigate host header poisoning/attack kindly make sure.

• Use the hostname instead of IP address in the header.

• Can refuse a request if it doesn't have the desired or expected host header. 

• For this, Add initial RewriteCond/RewriteRule pair to confirm the HOST requested is ABCDEF.com and error if not.

• To restrict add below lines between <VirtualHost :443> OR  <VirtualHost :80>  

File Name : httpd-ssl.conf  OR ssl.conf

*************************************************************

LoadModule rewrite_module modules/mod_rewrite.so

<VirtualHost :443>

    ServerName ABCDEF

    RewriteEngine on

    RewriteCond %{HTTP_HOST} !^www.abcdef.com [NC]

    RewriteCond %{HTTP_HOST} !^(www.abcdef.com|abcdef.com)$ [NC]

    RewriteCond %{REQUEST_URI} !^/error [NC]

    RewriteRule ^.(.*) - [L,F]

</VirtualHost>

*************************************************************

 ## Restrict the Use of IP address  in URL to access application.

File Name : httpd-ssl.conf  OR ssl.conf

*************************************************************

<VirtualHost :443>

 ServerName ABCDEF.com

  ServerAlias www.ABCDEF.com

 #UseCanonicalName will use the hostname and port specified in the ServerName or ServerAlias

 UseCanonicalName On   

  # Restrict the Use of IP adderss in URL

  SetEnvIf Host "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" HostHeaderIsIP=1

  RewriteEngine on

  RewriteCond %{ENV:HostHeaderIsIP} 1

  RewriteRule .* - [F]

</VirtualHost>

*************************************************************

Thanks 😊

Local File Inclusion Vulnerabilities OR Directory traversal attack

• The attacker can easily download system files with the help of directory traversal vulnerability.

• Address: https://www.example.com/example/download.jsp?fileName=../../../../etc/passwd

• Clicking on this link it will download /etc/passwd file 

• To restrict download add below lines <VirtualHost :443> OR  <VirtualHost :80>   .

File Name : httpd.conf & ssl.conf

*************************************************************

LoadModule rewrite_module modules/mod_rewrite.so

RewriteEngine on

RewriteCond %{THE_REQUEST} ^.*/\.

RewriteRule ^(.*)$ - [R=404]

*************************************************************

Thanks 😊

Information disclosure through server response headers Apache-Coyote & X-Powered-By (JBoss).

Vulnerable Response from the Jboss application server headers.

• Server: Apache-Coyote/1.1
• X-Powered-By: JSP/2.2

Change 1: for (Server: Apache-Coyote/1.1)

File Name: standalone.xml

*************************************************************

<system-properties>

        <property name="org.apache.coyote.http11.Http11Protocol.SERVER" value="DONTKNOW"/>

        <property name="org.jboss.as.sendServerHeader" value="false"/>

</system-properties>

*************************************************************

Change 2: for (X-Powered-By: JSP/2.2)

File Name: standalone.xml

*************************************************************

<subsystem xmlns="urn:jboss:domain:web:1.5" default-virtual-server="default-host" native="false">

            <configuration>

                <jsp-configuration x-powered-by="false" display-source-fragment="false"/>

            </configuration>

            <connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http"/>

            <connector name="ajp" protocol="AJP/1.3" scheme="http" socket-binding="ajp"/>

            <virtual-server name="default-host" enable-welcome-root="false">

                <alias name="localhost"/>

<subsystem/>

*************************************************************

Thanks 😊

Tomcat ghostcat vulnerability (JBoss /Tomcat)

• Ghostcat is a vulnerability found in Apache Tomcat versions 6.x, 7.x, 8.x, and 9.x that allows remote code execution
• Apache Tomcat includes the AJP connector, which is enabled by default and listens on all addresses on port 8009.
• which allows the attacker to get information from the application, including the `WEB-INF` and `META-INF` deployment folders.

Option1:

 if you are using AJP port on (Tomcat ) then update tomcat version to 

*************************************************************

Apache Tomcat has officially released versions 9.0.31, 8.5.51, and 7.0.100 to fix this vulnerability

*************************************************************

Option2: 

if you are not using AJP port on (Tomcat /JBoss) then disable/comment the same AJP port on server.xml /standalone.xml file.

*************************************************************

<connector name="ajp" protocol="AJP/1.3" scheme="http" socket-binding="ajp" enabled="false"/>

*************************************************************

Thanks 😊

SSL certificate supports Weak Ciphers/Encoding (3DES) (Apache 2.4)

• SSL Medium Strength Cipher Suites Supported (SWEET32) [TOMCAT server]
• The remote host uses weak cipher encryption for communication.
• Where SWEET32 is also called 3DES / Birthday attack.

To verify use below OpenSSL command:

If the OpenSSL is connected to the host at SSL port & we received the response with the certificate then it's having weak cipher suites.

• openssl s_client -connect Hostname:443 -cipher ""DES:3DES"" -tls1_2
• openssl s_client -connect Hostname:443 -cipher ""DES:3DES"" -tls1_1
• openssl s_client -connect Hostname:443 -cipher ""DES:3DES"" -tls1

SSLCipherSuite having strong cipher enabled, and to disable/restrict weak cipher using !DES:!RC4:!3DES:!MD5:!PSK

File Name: ssl.conf / httpd-ssl.conf

**************************************************

SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK

**************************************************

Thanks 😊

SSL Medium Strength Cipher Suites Supported (SWEET32) [Tomcat Server]

• The remote host uses weak cipher encryption for communication.
• Where SWEET32 is also called 3DES / Birthday attack.

To verify use below command: If the OpenSSL is connected to the host at SSL port & we received the response with the certificate then it's having weak cipher suites.

• openssl s_client -connect Hostname:443 -cipher ""DES:3DES"" -tls1_2
• openssl s_client -connect Hostname:443 -cipher ""DES:3DES"" -tls1_1
• openssl s_client -connect Hostname:443 -cipher ""DES:3DES"" -tls1

• We need to remove below high-lighted mark for weak ciphers & check the application for the same VA point on the instance.

File Name: $TOMCAT_HOME/conf/server.xml 

**************************************************

<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol" acceptorThreadCount="2" maxConnections="-1"

               SSLEnabled="true" scheme="https" secure="true"

               clientAuth="want" sslProtocol="TLS" sslEnabledProtocols="TLSv1.2,TLSv1.1,TLSv1" keystoreType="jks" keystoreFile="/app/apache-tomcat-7.0.81/cert/serverkeystore.jks" keystorePass="Password@123" truststoreFile="/app/apache-tomcat-7.0.81/cert/truststore.jks" truststorePass="Password@123" ciphers="TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256"/>

**************************************************

Thanks 😊

ETag vulnerability & X-Powered-By : jsp/2.2

• ETags from Web servers are also considered an information leakage vulnerability on web-server.
• Apache (httpd.conf & ssl.conf)
• Enable "LoadModule headers_module modules/mod_headers.so" 

*************************************************************

LoadModule headers_module modules/mod_headers.so

Header unset Server

Header unset Etag

ServerSignature Off

ServerTokens Prod

TraceEnable off

*************************************************************

To test: curl –I  http://ipAddressOrHostName:port

Disable X-Powered-By on (apache-Web / IBM HTTP Server).

• As the "x-powered-by: jsp/2.2" version is provided by application servers, that can be mitigated on Web-server also.
• Apache (httpd.conf & ssl.conf)
• Enable "LoadModule headers_module modules/mod_headers.so" 

*************************************************************

LoadModule headers_module modules/mod_headers.so

Header always unset "X-Powered-By"

Header unset "X-Powered-By"

*************************************************************

To test: curl –I  http://ipAddressOrHostName:port

Thanks 😊

Missing Security Header(x-xss-protection) & Clickjacking

Missing Security Header(x-xss-protection) Missing HTTP Headers

• missing X-XSS-Protection header which means that this website could be vulnerable to Cross-site Scripting (XSS) attacks.
• Apache (httpd.conf & ssl.conf)
• Enable "LoadModule headers_module modules/mod_headers.so" 

***********************************************

LoadModule headers_module modules/mod_headers.so

Header set X-Content-Type-Options "nosniff"

Header set X-XSS-Protection "1; mode=block"

***********************************************

OR

***********************************************

LoadModule headers_module modules/mod_headers.so

<IfModule mod_headers.c>

Header set X-XSS-Protection "1; mode=block"

</IfModule>

***********************************************

To test: 

curl –I  http://ipAddressOrHostName:port

Clickjacking 

• Clickjacking is also called an iframe window trick, the attacker can get the data while the user clicks on some buttons or links.
• Apache (httpd.conf & ssl.conf)
• Enable "LoadModule headers_module modules/mod_headers.so" 

***********************************************

LoadModule headers_module modules/mod_headers.so

Header set X-Frame-Options SAMEORIGIN

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Apache (httpd.conf & ssl.conf)

***********************************************

To test: curl –I  http://ipAddressOrHostName:port

Thanks 😊

Disable HTTP TRACE / TRACK / OPTIONS/DELETE Method.

• A local or remote unprivileged user may be able to abuse the HTTP TRACE/TRACK functionality to gain access to sensitive information in HTTP headers when making HTTP requests.

• For, Apache / IBM HTTP Server: add below parameters bewteen <virtualhost :443> tag  <virtualhost/> for PORT 80 & 443.

****************************************************

LoadModule rewrite_module modules/mod_rewrite.so

TraceEnable Off

RewriteEngine On

RewriteCond %{REQUEST_METHOD} ^TRACE

RewriteRule .$ - [F,L]

RewriteEngine On

RewriteCond %{REQUEST_METHOD} ^TRACK

RewriteRule .$ - [F,L]

RewriteEngine On

RewriteCond %{REQUEST_METHOD} ^PUT

RewriteRule .$ - [F,L]

RewriteEngine On

RewriteCond %{REQUEST_METHOD} ^OPTIONS

RewriteRule .$ - [F,L]

****************************************************

To check use below test cases,:  If you are getting 405 Method Not Allowed, then its work.

• curl -i -X OPTIONS http://ipAddressOrHostName:port
• curl -X TRACE localhost

Output:

***********

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">

<html><head>

<title>405 Method Not Allowed</title>

</head><body>

<h1>Method Not Allowed</h1>

<p>The requested method TRACE is not allowed for the URL /.</p>

</body>

</html>

***********

Thanks 😊