Exegesis of Virtual Hosts Hacking
This is the first paper written on the topic of virtual hosts hacking. It covers basic skills such as passive discovery techniques and (almost) stealth active discovery techniques. It also presents possible scenarios of exploitation.
Exegesis of Virtual Hosts Hacking was an experiment. The topic about hacking virtual hosts have been covered very vaguely in the past IMHO. This is the reason why me and Adrian Pastor decided to develop standard techniques which can be implemented into our personal toolkits. Of course this led to a paper which you can read now.
Investigating the virtual hosts that a web server may have is quite important when performing penetration testing. In order to gain access to a particular site, the attacker may not always go trough the font door but choose to enter through the backdoorl: in our case other virtual hosts. The most interesting bit in the paper is the actual investigation we’ve conducted at the time of writing. I am not completely sure how many readers realized the types of security implications that are behind the virtual hosting architecture.
Here is a snippet from the paper:
There is a lot that we can say about finding virtual hosts from a given IP address. Sometimes this task is straightforward, other times a bit of thinking is required. However, in general it is not a mission impossible.
During the last few years, domain name databases have emerged like mushrooms after a rainy day. This has certainly increased the awareness among security professionals about the possibility of using virtual hosts as backdoors when testing the security of a given organization. In reality, a good attacker will try to break into your organization by knocking on the not-so-obvious doors.
The process of getting all valuable virtual hosts usually falls into the passive, enumeration gathering practices and it is based on querying databases from the public sector. However, we will also look at some active enumeration techniques for finding virtual hosts.
In the following subsection we will discuss how to find virtual hosts by querying public databases and actively probing the domain name system (DNS) and the HTTP protocol itself.
