312-50 Question 283
Single answer▪ Web Server ConceptsDuring an authorized assessment, you discover that a target company's public web server responds differently to malformed HTTP requests. A normal GET request to the site works, but when you send a request with an invalid method and unusual header formatting, the server returns a detailed error page that includes "Apache/2.4.49 (Unix)" and a full filesystem path to the web root. The client asks what this means from a security perspective and what should be prioritized next in testing. Which action is the MOST appropriate?
- A
Treat the response as useful banner and error-message leakage, then verify whether the disclosed Apache version is exposed to known vulnerabilities and whether verbose errors can be suppressed
- B
Conclude the server is not vulnerable because it rejected the malformed request and move on to client-side testing
- C
Assume the filesystem path disclosure proves remote code execution is already possible and immediately report full compromise
- D
Focus only on DNS enumeration, because HTTP error handling does not provide meaningful attack-surface information
- E
Infer that the server must be running Microsoft IIS, because detailed errors and path disclosures are specific to IIS
Show answer and explanation
Correct answer: A
Explanation
This question tests practical understanding of web server concepts in reconnaissance and assessment. Detailed HTTP error pages can reveal the web server type, version, operating environment, and local path information. From a CEH perspective, that is actionable intelligence because it supports fingerprinting, vulnerability correlation, and identification of misconfigurations. The correct response is to treat the output as information disclosure and use it to guide controlled verification.
Apache HTTP Server documentation and security hardening guidance emphasize limiting version disclosure and avoiding unnecessary detail in server-generated responses, commonly through settings such as ServerTokens and ServerSignature. OWASP guidance also treats verbose error messages as an information leakage issue because they help attackers understand backend technologies and file locations. Best practice is to suppress detailed production error pages, expose minimal server-identifying information, keep the web server patched, and validate findings rather than assuming compromise from disclosure alone.
- A. Correct.
Correct. The response reveals two important web server concepts: banner/version disclosure and verbose error handling. In a CEH-style assessment, this information should be used to refine testing. The disclosed Apache version may help correlate the target with known issues if the version is outdated or misconfigured, while the exposed filesystem path can aid further enumeration, fuzzing, and validation of misconfiguration risks. The proper next step is verification, not assumption. It is also appropriate to recommend reducing version leakage and disabling overly detailed error output in production.
- B. Incorrect.
Incorrect. Rejecting a malformed request does not prove the server is secure. The detailed error page itself is a finding because it leaks implementation details that can help an attacker tailor follow-on attacks. CEH candidates should recognize that abnormal responses often provide reconnaissance value even when the original request fails.
- C. Incorrect.
Incorrect. Path disclosure does not by itself demonstrate remote code execution. It is evidence of information leakage, not proof of full compromise. A common mistake is to overstate impact based on a single indicator. An ethical hacker should document the exposure, assess exploitability, and validate whether any vulnerable functionality actually exists before making a severe claim.
- D. Incorrect.
Incorrect. DNS enumeration can be useful, but dismissing HTTP error behavior is wrong. Web server error handling can reveal server software, versions, directory structure, reverse proxy behavior, and application stack details. Those are directly relevant to attack-surface analysis and should not be ignored.
- E. Incorrect.
Incorrect. The response explicitly identifies Apache, not IIS. Also, verbose errors and path disclosures are not unique to IIS; many web servers and frameworks can leak such details when misconfigured. This option reflects a misunderstanding of web server fingerprinting and error handling.