312-50 Question 290
Single answer▪ Web Server Attack MethodologyDuring an authorized assessment, you identify a Linux-based web server hosting a customer-facing application. A banner grab and HTTP fingerprinting show Apache/2.4.x, and directory enumeration reveals several accessible paths, including /icons/ and /cgi-bin/. The client wants you to validate whether the web server itself is exposing unnecessary attack surface before moving to deeper application testing. Which action is the MOST appropriate next step in a web server attack methodology?
- A
Run a vulnerability check against the identified Apache version and review common web server misconfigurations such as exposed default content, dangerous HTTP methods, and insecure CGI exposure
- B
Immediately launch a password brute-force attack against the web server over SSH because Linux web servers commonly share credentials with web applications
- C
Focus only on SQL injection testing against dynamic parameters because web server fingerprinting is complete once the server type is known
- D
Exploit the /icons/ directory directly to obtain remote code execution because any accessible default directory on Apache indicates a confirmed compromise path
Show answer and explanation
Correct answer: A
Explanation
A practical web server attack methodology typically proceeds through information gathering, fingerprinting, enumeration, and then validation of server-specific weaknesses and misconfigurations before or alongside deeper application testing. In this scenario, Apache has been identified and potentially interesting directories such as /icons/ and /cgi-bin/ were found. The right next step is to evaluate the server for known vulnerabilities relevant to the detected version and configuration, and to verify whether default content, exposed CGI scripts, unnecessary modules, or risky HTTP methods increase the attack surface. This aligns with standard web server assessment practices reflected in resources such as the Apache HTTP Server documentation, OWASP Web Security Testing Guide guidance on configuration review and enumeration, and common CEH methodology emphasizing footprinting, enumeration, vulnerability analysis, and then exploitation only where justified and authorized.
- A. Correct.
Correct. In CEH-style web server attack methodology, once fingerprinting and content enumeration identify the server type and potentially exposed directories, the appropriate next step is to assess the web server's attack surface: version-specific vulnerabilities, unsafe modules/features, misconfigurations, exposed default files, risky HTTP methods such as PUT or DELETE if enabled, and insecure CGI handling. Accessible /cgi-bin/ and default-content directories like /icons/ do not automatically mean compromise, but they do justify further verification.
- B. Incorrect.
Incorrect. Brute-forcing SSH is not the most appropriate next step for assessing the web server attack surface described in the scenario. It also shifts scope from web server methodology to credential attacks against another service. Even in authorized testing, this would be a different attack path and should not be the first move when the task is specifically to validate web server exposure.
- C. Incorrect.
Incorrect. This reflects a common misconception that application-layer flaws such as SQL injection should always take priority. While SQL injection testing is important in a web assessment, the scenario specifically asks for the next step in web server attack methodology after fingerprinting and enumeration. At this stage, the tester should first evaluate server-level weaknesses and misconfigurations rather than ignoring them.
- D. Incorrect.
Incorrect. The presence of /icons/ is often associated with default Apache content, but it is not itself evidence of a remotely exploitable condition. Similarly, /cgi-bin/ may be legitimate and secure. Assuming remote code execution from directory exposure alone is an overreach and not consistent with sound testing methodology. The correct approach is verification through controlled checks, not immediate exploitation assumptions.