Server's

Cracking/Protecting a Server
 Most organizations have websites.Most websites store valuable information such as credit card numbers, email address and passwords etc(These servers can be in different locations, but all information is located on some sort of server). This has made them targets to attackers. Defaced websites can also be used to communicate religious or political ideologies etc.
Server vulnerabilities
A web server is program that stores files (usually web pages) and makes them accessible via the network or internet. A web server requires both hardware and software. Attackers usually target the exploits in the software to gain authorized entry to the server. Let’s look at some of the common vulnerabilities that attackers take advantage of.

• Default settings– These settings such as default user id and passwords can be easily guessed by the attackers. Default settings might also allow perform certain tasks such as running commands on the server which can be exploited. p { margin-bottom: 0.1in; line-height: 120%; }
  For the OS or server software, generally no. For pre-made websites, almost without a doubt
  p { margin-bottom: 0.1in; line-height: 120%; }For the OS or server software, generally no. For pre-made websites, almost without a doubt)
• Misconfiguration of operating systems and networks – certain configuration such as allowing users to execute commands on the server can be dangerous if the user does not have a good password.
• Bugs in the operating system and web servers– discovered bugs in the operating system or web server software can also be exploited to gain unauthorized access to the system.

In additional to the above mentioned web server vulnerabilities, the following can also led to unauthorized access
Lack of security policy and procedures– lack of a security policy and procedures such as updating antivirus software, patching the operating system and web server software can create security loop holes for attackers.

Types of Web Servers
The following is a list of the common web servers :

• Apache : This is the commonly used web server on the internet. It is cross platform but is it’s usually installed on Linux. Most PHP websites are hosted on apache servers.
• Internet Information Services (IIS) : It is developed by Microsoft. It runs on windows and is the second most used web server on the internet. Most asp and aspx websites are hosted on IIS servers.
• Apache Tomcat : Most Java server pages (jsp) websites are hosted on this type of web server.
• Other web servers : These include Novell's Web Server and IBM’s Lotus Domino servers.
• p { margin-bottom: 0.1in; line-height: 120%; }
  NGINX : Open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server

Types of Attacks against Web Servers

• Directory traversal attacks– This type of attacks exploits bugs in the web server to gain unauthorized access to files and folders that are not in the public domain. Once the attacker has gained access, they can download sensitive information, execute commands on the server or install malicious software.
• Denial of Service Attacks– With this type of attack, the web server may crash or become unavailable to the legitimate users.
• Domain Name System Hijacking – With this type of attacker, the DNS setting are changed to point to the attacker’s server. All traffic that was supposed to be sent to the web server is redirected to the wrong one.
• Sniffing– Unencrypted data sent over the network may be intercepted and used to gain unauthorized access to the web server.
• Phishing– With this type of attack, the attack impersonates the websites and directs traffic to the fake website. Unsuspecting users may be tricked into submitting sensitive data such as login details, credit card numbers etc.
• Pharming– With this type of attack, the attacker compromises the Domain Name System (DNS) servers or on the user computer so that traffic is directed to a malicious site.
• Defacement– With this type of attack, the attacker replaces the organization’s website with a different page that contains the hacker’s name, images and may include background music and messages.

Effects of successful attacks
An organization’s reputation can be ruined if the attacker edits the website content and includes malicious information or links to a porn website
The server can be used to install malicious software on users who visit the compromised website. The malicious software downloaded onto the visitor’s computer can be a virus, Trojan or botnet software etc.
Compromised user data may be used for fraudulent activities which may lead to business loss or lawsuits from the users who entrusted their details with the organization
Web server attack tools

• Some of the common server attack tools include;
• Metasploit– this is an open source tool for developing, testing and using exploit code. It can be used to discover vulnerabilities in web servers and write exploits that can be used to compromise the server.
• MPack– this is a web exploitation tool. It was written in PHP and is backed by MySQL as the database engine. Once a web server has been compromised using MPack, all traffic to it is redirected to malicious download websites.
• Zeus– this tool can be used to turn a compromised computer into a bot or zombie. A bot is a compromised computer which is used to perform internet based attacks. A botnet is a collection of compromised computers. The botnet can then be used in a denial of service attack or sending spam mails.
• Neosplit – this tool can be used to install programs, delete programs, replicating it etc.

How to avoid attacks on Web server
An organization can adopt the following policy to protect itself against web server attacks.

• Patch management– this involves installing patches to help secure the server. A patch is an update that fixes a bug in software. The patches can be applied to the operating system and the web server system.
• Secure installation and configuration of the operating system
• Secure installation and configuration of the web server software
• Vulnerability scanning system– these include tools such as Snort, NMap, Scanner Access Now Easy (SANE)
• Firewalls can be used to stop simple DoS attacks by blocking all traffic coming the identify source IP addresses of the attacker.
• Antivirus software can be used to remove malicious software on the server
• Disabling Remote Administration
• Default accounts and unused accounts must be removed from the system
• Default ports & settings (like FTP at port 21) should be changed to custom port & settings (FTP port at 5069)