Exploiting HTTP Content Negotiation
A couple of days ago I sent an email to the w3af-users mailing list about a nice little trick that can be used to get a partial directory listing using mod_negotiation’s HTTP content negotiation feature. After half an hour or coding, and some minutes of testing, I had a new discovery plugin for w3af that could exploit this feature.
Before going into detail about this technique I have to say that by no means I have the credit for discovering it, Stefano Di Paola pointed me that he blogged about it in 2007; and I found out about it reading the report of a commercial Web Application Scanner which was handed to me by a client. It seems that this is one of those not-so-known vulnerabilities that resurface from time to time.
The idea about this post is to make this vulnerability widely known and show that there is an automated way of exploiting it with w3af. This can be really helpful when performing the information gathering phase of a Web Application Penetration Test in order to find new resources like backup files (users.zip), old versions of scripts with extensions that won’t be interpreted by Apache (users.php.old), etc.
Enough with the introduction, here is the trick:
GET /backup HTTP/1.0
Accept: foobar/xyz
User-Agent: w3af
Host: 192.168.150.2
Connection: Close
HTTP/1.1 406 Not Acceptable
content-length: 770
vary: negotiate,accept
server: Apache/2.2.8 (Ubuntu)
tcn: list
connection: close
date: Thu, 04 Jun 2009 13:37:35 GMT
content-type: text/html; charset=iso-8859-1
alternates:
{"backup.php.bak" 1 {type application/x-trash} {length 0}},
{"backup.php.old" 1 {type application/x-trash} {length 0}},
{"backup.tgz" 1 {type application/x-gzip} {length 0}},
{"backup.zip" 1 {type application/zip} {length 0}}
What is basically happening here is that we are sending a specially crafted request to the “/backup” resource, with an invalid “Accept” header. Apache receives this request, which is then forwarded to mod_negotiation. This module lists the contents of the “/” directory, and creates a list with the alternates for the backup resource thats then returned in the alternates header.
The only problem with this technique is that it will only include a file as an alternate if the file has a known extension. Known extensions in Apache are defined (at least in Ubuntu) by /etc/mime.types and by the AddType directives in Apache’s config file. To understand why this is a problem, here is the directory listing for the webroot of the test environment:
dz0@brick:/var/www$ ls backup* backup.php~ backup.php.bak backup.php.lala backup.php.old backup.tgz backup.zip
You should notice that the backup.php~ and backup.php.lala weren’t included in the alternates response header.
There is a very detailed post from Matt Tesauro describing this technique, which was written based on his tests performed with mod_negotiation and mod_spelling that is also worth reading.
Exploiting
The objective of this exploit is to gather information about new and unknown resources in a very performant way. When mod_negotiation is disabled, and no directory listing is available, the only way to get a full list of the files inside a directory is by bruteforcing them. Bruteforce attacks can take a lot of time, and are mostly useless if performed blindly.
Using this technique, I created a new discovery plugin called “content_negotiation” that will perform these steps:
- Identify if mod_negotiation is enabled
- For every file found by the discovery.webSpider plugin, list alternate resources.
- For every directory found by the discovery.webSpider plugin, perform a small bruteforce with common file names.
w3af>>> plugins w3af/plugins>>> discovery content_negotiation, webSpider w3af/plugins>>> back w3af>>> target w3af/config:target>>> set target http://localhost/w3af/discovery/content_negotiation/backup.php w3af/config:target>>> back w3af>>> start HTTP Content negotiation is enabled in the remote web server. This could be used to bruteforce file names and find new resources. This information was found in the request with id 27. New URL found by webSpider plugin: http://localhost/w3af/discovery/content_negotiation/ New URL found by content_negotiation plugin: http://localhost/w3af/discovery/content_negotiation/backup.gz New URL found by content_negotiation plugin: http://localhost/w3af/discovery/content_negotiation/backup.tar New URL found by content_negotiation plugin: http://localhost/w3af/discovery/content_negotiation/backup.zip
The plugin is publically available in the SVN version of w3af , test it with your web server, and comment on this blog post or in the w3af-users mailing list about your experiences with it. If you have ideas on how to improve the plugin, or different ways of exploiting this mod_negotiation feature I would love to hear about them!
I’m sure that attendees in our Web Application Security Training course will love to play with this new w3af plugin :)