A bakery website that says too much
A small bakery asks a friend to put its website online. It works, and customers find the prices.
But the server also tells every visitor its exact version. It lists the files in a folder. It even hands out a hidden folder from the friend's laptop. Nobody noticed, because the site looked fine.
The one rule
Warning
Look only at your own copy of the lab, or a site you have written permission to test. Your copy has no way out to the internet. We look for these faults so we can close them before anybody else finds them.
By the end of this lesson
Note
I can publish a website with safe settings.
Key words
| Word | What it means | Example |
|---|---|---|
| Publish | to put a website where anybody can reach it | |
| Configuration | the settings file that tells a server how to behave | |
| Directive | one setting in an nginx configuration | autoindex on; |
| Folder listing | a page the server makes that lists every file in a folder | |
| Security header | a header that asks the browser to be more careful | X-Content-Type-Options |
| Hardening | changing settings so a server gives away less |
The cells students fill in are left blank in this preview.
Before you start
Note
Press Start the lab and wait until it says it is running. The website is called web. In this terminal, docker exec web runs one command inside the web server, so you can read its files.
What any visitor can see
When you publish a site, every visitor can send it any request. So the question is what each one gives away.
The next three Runs ask what an attacker asks first. Which version are you? What is in your folders? Did you leave anything behind?
Which version is the server?
curl -s -I http://web | grep -i "^server"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Does a folder list its files?
curl -s http://web/files/ | grep -o "Index of [a-z/]*"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Can anybody read the hidden folder?
curl -s -o /dev/null -w "%{http_code}\n" http://web/.git/configShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: what each answer gives away
| What you asked | What the lab said | Why it matters |
|---|---|---|
| The Server header | nginx/1.27.5 | An attacker can look up known flaws in that exact version |
| The /files/ folder | Index of /files/ | Every file in the folder is listed, even ones nobody linked to |
| /.git/config | 200 | A hidden folder of the site's history is public, and it can hold old passwords |
The cells students fill in are left blank in this preview.
The settings live in one file
nginx reads its configuration from a text file. Each line inside the braces is a directive: a name, a value and a semicolon.
Read the lab's file with the next Run. Find the two directives with the value on. Each one causes one of the problems you just saw.
Read the server's settings
docker exec web cat /etc/nginx/conf.d/default.confShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: two risky directives
| Directive | What it does | What a visitor sees |
|---|---|---|
| server_tokens on; | Puts the version in the Server header | nginx/1.27.5 |
| autoindex on; | Lists a folder that has no home page | Index of /files/ |
The cells students fill in are left blank in this preview.
Check the file before it is used
docker exec web nginx -tShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Security headers ask the browser for care
Some dangers are on the visitor's side. A security header tells the browser to be careful with the page.
X-Content-Type-Options: nosniff tells it never to guess what a file is. X-Frame-Options stops another site showing your page inside its own. The next Run counts how many times the first one is sent.
Count one security header
curl -s -I http://web | grep -ci "x-content-type-options"Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think hiding the version number makes a server safe. It only removes one clue: the old software and its flaws are still there. Keep the software up to date, and hide the version as well.
Going further: a backup left behind
Type curl -s -o /dev/null -w "%{http_code}\n" http://web/config.php.bak in the terminal. Do not print the file itself.
A file ending in .bak is often an old copy of a settings file. What code comes back? What might such a file hold, and how could the server refuse it?