This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Testing for Error Code (OTG-ERR-001)"

From OWASP
Jump to: navigation, search
m (Brief Summary)
(Description of the Issue)
Line 13: Line 13:
  
 
A common error that we can see during our search is the HTTP 404 Not Found.
 
A common error that we can see during our search is the HTTP 404 Not Found.
Often we can see this error code with many details about web server and other components.
+
Often this error code provides useful details about the underlying web server and associated components. For example:  
For Example:
 
  
 
<pre>
 
<pre>
Line 22: Line 21:
 
</pre>
 
</pre>
  
This error message can be generated with the insertion of non-existing URL.
+
This error message can be generated by requesting a non-existant URL.
 
After the common message that shows a page not found, there is information about web server version, OS, modules and other products used.
 
After the common message that shows a page not found, there is information about web server version, OS, modules and other products used.
This information can be very important both for OS and for applications during a penetration test, but web server errors aren't the only errors useful in a security analysis.
+
This information can be very important from an OS and application type and version identification point of view.
  
We will therefore the next occurrence that shows abnormal behavior:
+
Web server errors aren't the only useful output returned requiring security analysis. Consider the next example error message:
  
 
<pre>
 
<pre>
Line 33: Line 32:
 
</pre>
 
</pre>
  
What's happened? We'll proceed step by step.
+
What happened? We will explain step-by-step below.
  
For example, the 80004005 is a generic IIS error code which indicates that isn't possible to access a database.<br>
+
In this example, the 80004005 is a generic IIS error code which indicates that it could not establish a connection to its associated database.<br>
In many cases we can see that this code is followed by the version of the database. With this information, the pentester can plan an appropriate strategy for the security test.
+
In many cases, the error message will detail the type of the database. This will often indicate the underlying operating system by association. With this information, the penetration tester can plan an appropriate strategy for the security test.
 +
 
 +
By manipulating the variables that are passed to the database connect string, we can invoke further more detailed errors.
 
<pre>
 
<pre>
 
Microsoft OLE DB Provider for ODBC Drivers error '80004005'
 
Microsoft OLE DB Provider for ODBC Drivers error '80004005'
Line 42: Line 43:
 
</pre>
 
</pre>
  
The first example shows a connection error message obtained by SQL Server Database because the database server which linked into application is down or credentials don't allow access.
+
In this example, we can see a generic error in the same situation which reveals the type and version of the associated database system and a dependence on Windows operating system registry key values.
However, this isn't the only information that we know; in fact, in this way we have discovered the kind of operating system.
 
In this case we could verify if the web application permits change of variables value to connect to the database.
 
In the second case we can see a generic error in the same situation (we know the database version) but with a different error message and database server.
 
But in the end...It's the same thing!
 
  
 
Now we will look at a practical example with a security test on web application that loses the link with the database server because there is badly written code (the next error message is caused by the application, which can't resolve the database server name or when the variable value is modified) or other network problems.
 
Now we will look at a practical example with a security test on web application that loses the link with the database server because there is badly written code (the next error message is caused by the application, which can't resolve the database server name or when the variable value is modified) or other network problems.

Revision as of 10:50, 8 February 2007

[Up]
OWASP Testing Guide v2 Table of Contents

Brief Summary

Often during a penetration test on web applications we come up against many error codes generated from applications or web servers. It's possible to cause these errors to be displayed by using a particular request, either specially crafted with tools or created manually. These codes are very useful to penetration testers during their activities because they reveal a lot of information about databases, bugs, and other technological components directly linked with web applications. Within this section we'll analyse the more common codes (error messages) and bring into focus the steps of vulnerability assessment. The most important aspect for this activity is to focus one's attention on these errors, seeing them as a collection of information that will aid in the next steps of our analysis. A good collection can facilitate assessment efficiency by decreasing the overall time taken to perform the penetration test.

Description of the Issue

A common error that we can see during our search is the HTTP 404 Not Found. Often this error code provides useful details about the underlying web server and associated components. For example:

Not Found
The requested URL /page.html was not found on this server.
Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.7g  DAV/2 PHP/5.1.2 Server at localhost Port 80

This error message can be generated by requesting a non-existant URL. After the common message that shows a page not found, there is information about web server version, OS, modules and other products used. This information can be very important from an OS and application type and version identification point of view.

Web server errors aren't the only useful output returned requiring security analysis. Consider the next example error message:

Microsoft OLE DB Provider for ODBC Drivers (0x80004005)
[DBNETLIB][ConnectionOpen(Connect())] - SQL server does not exist or access denied 

What happened? We will explain step-by-step below.

In this example, the 80004005 is a generic IIS error code which indicates that it could not establish a connection to its associated database.
In many cases, the error message will detail the type of the database. This will often indicate the underlying operating system by association. With this information, the penetration tester can plan an appropriate strategy for the security test.

By manipulating the variables that are passed to the database connect string, we can invoke further more detailed errors.

Microsoft OLE DB Provider for ODBC Drivers error '80004005'
[Microsoft][ODBC Access 97 ODBC driver Driver]General error Unable to open registry key 'DriverId'

In this example, we can see a generic error in the same situation which reveals the type and version of the associated database system and a dependence on Windows operating system registry key values.

Now we will look at a practical example with a security test on web application that loses the link with the database server because there is badly written code (the next error message is caused by the application, which can't resolve the database server name or when the variable value is modified) or other network problems.

For example, we have a database administration web portal which can be connected to db server after a log-on phase to realize queries, create tables and modify database fields. During POST of credentials for the log-on phase meet this message that evidences the presence of a MySQL database server:

Microsoft OLE DB Provider for ODBC Drivers (0x80004005)
[MySQL][ODBC 3.51 Driver]Unknown MySQL server host

If we see in the HTML code of the log-on page the presence of a hidden field with a database IP, we can try to change this value in the URL with the address of another database (our database, for example). Another example: knowing the database server that services a web application, we can take advantage of this information to carry out a SQL Injection for that kind of database or a persistent XSS test.

Information Gathering on web applications with server-side technology is quite difficult, but the information discovered can be useful for the correct execution of an attempted exploit and can reduce false positives.

Black Box testing and example

Test:

telnet <host target> 80
GET /<wrong page> HTTP/1.1
<CRLF><CRLF>

Result:

HTTP/1.1 404 Not Found
Date: Sat, 04 Nov 2006 15:26:48 GMT
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.7g
Content-Length: 310
Connection: close
Content-Type: text/html; charset=iso-8859-1

Test:

1. network problems
2. bad configuration about host database address

Result:

Microsoft OLE DB Provider for ODBC Drivers (0x80004005) '
[MySQL][ODBC 3.51 Driver]Unknown MySQL server host

Test:

1. Authentication Failed
2. Credentials not inserted

Result:

Firewall version used for authentication

Error 407
FW-1 at <firewall>: Unauthorized to access the document.
•  Authorization is needed for FW-1.
•  The authentication required by FW-1 is: unknown.
•  Reason for failure of last attempt: no user

Gray Box testing and example

Test:

Enumeration of the directories with access denied.

http://<host>/<dir>

Result:

Directory Listing Denied
This Virtual Directory does not allow contents to be listed.
Forbidden
You don't have permission to access /<dir> on this server.

References

  • [1] [RFC2616] Hypertext Transfer Protocol -- HTTP/1.1



OWASP Testing Guide v2

Here is the OWASP Testing Guide v2 Table of Contents