victorfrankenstein@yahoo.com writes:
Helo
I'm currently doing a pen-test against my company site. We have a
web application runing over tomcat - in jsp format, one of my goals
is try to conect to my datebase from internet using my webapp
code. I try to download the jsp files from web server but when i
chek it the file contets is only a html code, for this propose i do
it whit linux wget, flashget, and others but all ways whit the same
result. If any one colud give me any idea about how can i downlad
the full jsp file i will appreciate a lot.
Hi Victor,
What you're learning here is how the web application server interprets
the jsp and outputs only the html result of its evaluation. Despite
the url ending in .jsp, the server is (quite by design) sending you
the _output_ of the .jsp evaluation, and not the source itself.
Short of compromising the server (or using your own legitimate access
to it as a company employee) to gain source file transfer ability
directly via ftp/tftp or the like, if you want the web server to give
up the jsp source, the most common ways are to
o search for backup versions of the file by fuzzing on common
backup file extensions e.g. for blah.jsp try to get
blah.jsp.bak blah.jsp~ etc. Web app testing software like
paros proxy and I believe nikto will looks for these and
several other variants of url's found during their spider of
the site.
o there are several jsp source disclosure vulns out there worth
trying as well. Here's a search for "jsp source disclosure"
at Security Focus for example
http://search.securityfocus.com/swsearch?sbm=%2F&metaname=alldoc&query=jsp+source+disclosure&x=0&y=0
Automated web vuln scanners will look for many of these vulns. Nikto
and Paros are two free tools that are easy to find that will help look
for jsp source disclosure possibilities. Commercial tools like IBM
Rational Appscan (Watchfire Appscan), or HP (SPI Dynamics) WebInspect
also flag these goodies rather reliably.
Hopefully others will chime in with other tools/tips for finding vulns
like this that can complement manual fuzzing of requests to see what
might trigger a jsp disclosure.
Cheers,
--
Todd Haverkos
http://www.linkedin.com/in/toddhaverkos
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!
http://www.cenzic.com/downloads
------------------------------------------------------------------------
