Category: HowTo

Using Whitelisting to control file access in Apache Webserver

Fuseki
Fuseki has started his career as software developer, but quickly switched over to network administration. After 7 years as network engineer, incl. one year in a management position, he entered a new team, working as penetration tester and security consultant. In addition to this, malware analysis and digital forensics are becoming more and more part of Fusekis daily work.

Fuseki has studied Information Technology as well as Software Technology and holds a diploma in each of these.
Latest posts by Fuseki (see all)

The aim

You want to control which files on your webserver can be accessed by whom, but you don’t want to use blacklisting. You want to say, i.e., external users can access files whose names end with .php, .jpg and .png. All other files must not be accessible, no matter which name they have.

You can use LocationMatch and FilesMatch to control access to files. In this example, we will use FilesMatch, because we care about files which are stored on the filesystem. But the same approach also applies to files, which are generated when requested.

The problem

When apache finds a FilesMatch entry in its configuration which matches the requested filename, the corresponding rules are applied. There is no problem with that as long as you do not try to create a catch-all rule Continue reading “Using Whitelisting to control file access in Apache Webserver”

HTTP Side-Channel Attacks with Burp Suite

SecMyth
After learning to inspect security from all perspectives from Prof. Pfitzmann at the University, I am now working as Penetration tester and IT Security Consultant since 2009. I have seen many many different applications, architectures and technologies since then.
Web Applications, Web Services, Oracle, MySQL, Linux, SAP R3 are my focus technologies, while my activities are widely spreaded: manual penetration tests, static code analysis, code reviews, consulting, project management
Latest posts by SecMyth (see all)

Ever wanted a simple tool capable of performing a side-channel attack of HTTP requests? A common use case would be to test of the login action takes more time of the provided username is known by the system compared to an unknown username. The theory behind such an attack is that the code performing the login stops more early in the flow if the used username is not present in the system.

Well, to test such a weakness it is necessary to perform certain HTTP requests, e.g. logins, and to capture the need time to receive a response. But what tools are fulfilling these requirements? The search can’t be this hard. In fact the most common Continue reading “HTTP Side-Channel Attacks with Burp Suite”