Solved

Default/Sample Web Directories Exist

Posted on 2009-05-04
9
272 Views
Last Modified: 2012-05-06
Many web directories that are installed by default contain sample files that were not meant for external access. These files could contain potentially sensitive system or propriety information that could be accessible by an external attacker. In addition a lot of these sample files and folders are vulnerable to known exploits and attacks that, at a minimum, could result in a denial of service attack, or lead to complete system compromise in a worst case scenario.
0
Comment
Question by:Brijeshk9
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
9 Comments
 
LVL 48

Expert Comment

by:Tintin
ID: 24301825
Nice statement.  Did you have a question?
0
 

Author Comment

by:Brijeshk9
ID: 24301897
its one of the Website Vulnerabilities identified by scanner, Now i need solution on it....?
0
 
LVL 14

Expert Comment

by:agriesser
ID: 24302350
Depending on the Apache version you're running, you can simply shut off these directories (like the documentaion alias, etc.) unload unneeded server modules like the serverinfo and status modules, etc.

To disable/modify virtual host configurations on Apache2 based webservers, go to the directory "/etc/apache2/sites-enabled", look through all the symlinks in there and remove the ones you don't need.
Don't worry, if you accidentally deleted one they're still there in the "/etc/apache2/sites-available" directory and can be re-established with the command `ln -s /etc/apache2/sites-enabled/NAME /etc/apache2/sites-available/NAME`.

Then, when you have tuned your webserver configuration, you can have a look at the modules that are loaded in your server and wipe out the ones that are not needed. The enabled modules are (like the VHosts) in a separate directory which is called /etc/apache2/mods-enabled (vs. /etc/apache2/mods-available where all available modules are listed) and remove the ones you don't need.

After you're done, reload the apache configuration with `/etc/init.d/apache2 reload` and run your scanning tool again to find out if things got better.

Unfortunately, without knowing what your scanning tool has mentioned as security flaws I cannot give you an exact answer about what to disable and what not. That also mostly depends on what your applications need from your webserver.
0
Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

 

Author Comment

by:Brijeshk9
ID: 24310577
Please find the below given evidences given by scanning Tool:..
http://XX.XX.XX.XX/uddi/ 
http://XX.XX.XX.XX/help/index.htm
http://XX.XX.XX.XX/uddi/inquiry
http://XX.XX.XX.XX/uddi/demo/jsp/searchForm.jsp
[NOTE: WHERE XX IS MENTIONED AS IP]
0
 
LVL 70

Expert Comment

by:Jason C. Levine
ID: 24333265
Did you create those directories and files or were they installed by default?

If you created them, ignore the warning.  If they were installed by default then agriesser has already provided the solution.
0
 
LVL 51

Accepted Solution

by:
ahoffmann earned 500 total points
ID: 24333558
> Now i need solution on it..
I'm pretty sure the scanner told you what should be done (otherwise get your money back:)

Anyway, you either simply have to remove the default web site, or configure the web server to deny access to it.
0
 

Author Closing Comment

by:Brijeshk9
ID: 31577886
Problem resolved
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

An enjoyable and seamless user experience can go a long way on an eCommerce site. While a cohesive layout and engaging copy play roles in creating a positive user experience, some sites neglect aspects that seem marginal but in actuality prove very …
Does your audience prefer people in photos or no people? How can you best highlight what you’re selling? What are your competitors doing, and what can you do that is different and unique from them?  Continue reading to learn how to make your images …
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.
In a previous video, we went over how to export a DynamoDB table into Amazon S3.  In this video, we show how to load the export from S3 into a DynamoDB table.

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question