Leung, Annie LDB:EX wrote:
Hi list members,
The scenario is that a web site is running in a Windows 2000 machine with
Oracle web/application server environment (Apache-based), J2EE, HTML. The
web application is deployed by logged in using the administrator account
I don't understand this. Apache has its own authentication scheme for
web users. I hope you mean that
Apache is running with admin privileges.
(cloned from the original). That implies the web application runs with admin
privileges, right? Database and authentication details are in other servers.
Q1: What are the risks for a web application running with admin privileges?
If Apache is running with admin privileges, the following techniques
will have greater impact:
- stealth commanding
- directory transversal
- file disclosure
as the attacker will be able to access files and execute commands
allowed only to root.
If the application authenticates itslef as an admin to the database
server, SQL injection will be
much more dangerous than if a normal user account with restricted
privileges is used.
Q2: In this scenario, is it easier or no difference when trying to deface a
web site? Is it really depending on how the pages are coded?
How the pages are coded influences the presence or absence of
vulnerabilities. If Apache is running
as admin, those vulnerabilities will introduce even more risk to the
overall architecture.
Hope this helps.
-------------------------------
Rafael San Miguel Carrasco
Consultor Técnico
rafael.sanmiguel@dvc.es
+ 34 660 856 647
+ 34 902 464 546
Davinci Consulting - www.dvc.es
Oficina Madrid - Parque empresarial Alvento
Via de los Poblados 1 Edificio A 6ª planta
28033 Madrid
-------------------------------
