Network Security Assessment, 3rd Edition

Chapter 14. Assessing Web Application Frameworks

Application frameworks interpret and execute code written in languages such as Java, PHP, Python, and Ruby. Frameworks can be bundled within larger web server packages (e.g., ASP.NET within Microsoft IIS) or run using distinct application and web server components (such as JBoss Application Server running atop of Apache Tomcat). Figure 14-1 demonstrates popular application and web server configurations (note: many of these frameworks can also be presented using alternate web servers).

Figure 14-1. Common application framework configurations

In many cases, developers are responsible for application security, and IT operations staff infrastructure security. Exploitable gaps might exist if parties neglect to harden the framework components between these layers.

This chapter describes application framework investigation and exploitation.

Framework and Data Store Profiling

Chapter 13 describes application framework fingerprinting through the following:

• Review of HTTP headers (e.g., Server and X-Powered-By)

• Analysis of cookies set upon connecting (primarily session variables)

• Analysis of filenames, extensions, and directory structures

• Review of metadata within content (e.g., HTML and JavaScript)

Automated tools that you can use to further investigate and profile application framework components include BlindElephant,¹ WAFP, ...