312-50 Question 289
Single answer▪ Web Server Attack MethodologyDuring an authorized assessment, you identify a public web server hosting a customer portal. Nmap shows TCP 80 and 443 open, and banner-grabbing suggests Apache is in use. The client wants you to follow a web server attack methodology to identify likely weaknesses before attempting exploitation. Which action should you perform FIRST to most effectively guide the rest of your testing?
- A
Enumerate the web server and application structure, including server version, modules, virtual hosts, directories, and default files
- B
Launch a password brute-force attack against the web administrator interface to quickly gain access
- C
Exploit Apache immediately using a public CVE that affects an older version of the server
- D
Flood the server with malformed HTTP requests to determine whether it fails open under load
Show answer and explanation
Correct answer: A
Explanation
In CEH-style web server attack methodology, the workflow typically begins with information gathering and enumeration before any exploitation attempts. After discovering a web service, an assessor should enumerate the server and its content to identify the precise attack surface: server type and version, default files, directories, virtual hosts, risky HTTP methods such as PUT or DELETE if enabled, administrative interfaces, sample scripts, and potential misconfigurations. This mirrors common practice in web assessments and aligns with guidance from sources such as OWASP Web Security Testing Guide (information gathering and configuration/deployment management testing) and vendor hardening documentation for Apache HTTP Server. Enumeration results drive the next steps, such as checking for outdated modules, exposed files, weak authentication points, insecure methods, or known vulnerabilities. Starting with brute force, direct exploitation, or availability-impacting tests skips the essential validation phase and is not considered sound methodology.
- A. Correct.
Correct. In a proper web server attack methodology, the first practical step after identifying the service is enumeration and footprinting of the web server and hosted content. That includes identifying the exact server software and version, enabled HTTP methods, directories, default pages, virtual hosts, sample applications, and exposed files such as robots.txt or backup files. This information helps determine attack surface and whether subsequent testing should focus on misconfiguration, outdated components, risky modules, dangerous HTTP methods, or exposed administrative resources.
- B. Incorrect.
Incorrect. Brute-forcing an admin interface is not an appropriate first step in a disciplined methodology. You should first confirm whether such an interface exists, whether authentication is actually exposed, and whether testing credentials is in scope and rate-limit safe. Jumping directly to brute force is noisy, may violate engagement constraints, and ignores easier, lower-risk findings such as default content, misconfigurations, or version-specific weaknesses.
- C. Incorrect.
Incorrect. Attempting to exploit a public CVE immediately based only on a banner is poor methodology. Web server banners can be misleading, intentionally obfuscated, or fronted by reverse proxies and load balancers. A professional assessor first validates the technology stack and enumerates the environment before selecting safe, relevant tests. Exploitation without sufficient confirmation can waste time or cause unintended disruption.
- D. Incorrect.
Incorrect. Sending malformed or stress-inducing HTTP traffic is closer to denial-of-service testing, which is typically tightly controlled or excluded from standard web server assessments unless explicitly authorized. It also does not represent the first step in web server attack methodology. Enumeration provides much more actionable intelligence with lower risk.