Fuzzing - CraftedSignal Threat Feed

Web Server Error Response Spike Indicating Reconnaissance

hello@craftedsignal.io — Tue, 23 Jan 2024 12:00:00 +0000

This threat brief addresses the risk of reconnaissance activities targeting web servers, specifically focusing on the detection of unusual spikes in HTTP error response codes (500, 502, 503, and 504). An adversary might employ vulnerability scanning or fuzzing techniques to identify weaknesses in web applications. These actions often result in a high volume of error responses as the attacker probes various endpoints and inputs. The detection rule applies to various web server platforms, including Nginx, Apache, Apache Tomcat, IIS, and Traefik. This activity is significant for defenders because successful reconnaissance can precede more severe attacks, such as data exfiltration or system compromise, by revealing exploitable vulnerabilities. The rule is designed to trigger when the number of 5xx errors exceeds a defined threshold within a specified time interval.

Attack Chain

The attacker initiates a reconnaissance phase by sending a series of HTTP GET requests to the target web server.
The attacker uses vulnerability scanning tools to probe for known weaknesses in the web application, generating various types of requests, including invalid or malformed URLs.
The web server processes each request, and those that encounter errors (e.g., invalid input, non-existent pages, server-side exceptions) result in 5xx error codes.
A high volume of these error responses are generated over a short period if the scanning tool aggressively probes the web server.
The attacker analyzes the error responses to identify potential vulnerabilities or misconfigurations.
The attacker may use identified vulnerabilities to perform additional scans or attempt to exploit the system.
If successful, the attacker gains unauthorized access to the web server or underlying system.
The attacker may proceed to further escalate privileges, install malware, or exfiltrate sensitive data.

Impact

A successful reconnaissance campaign can lead to the discovery of vulnerabilities that allow attackers to compromise web servers. This can result in data breaches, service disruptions, and reputational damage. While the error spike itself is a low-severity indicator, it can be a precursor to more critical attacks. The number of affected systems can range from a single server to an entire infrastructure, depending on the scope of the attacker's reconnaissance.

Recommendation

Deploy the Sigma rule "Web Server Potential Error Response Spike" to your SIEM to detect unusual spikes in 5xx error codes (rule.name).
Investigate any alerts generated by the Sigma rule, focusing on the source IP addresses and requested URLs to identify potential scanners (rule.note).
Implement rate limiting and blocking mechanisms at the edge (e.g., reverse proxy, WAF) to mitigate identified malicious traffic (rule.note).
Review web server and application logs for patterns indicative of vulnerability scanning or fuzzing attempts, paying attention to User-Agent strings and request parameters (rule.note).

Web Server Discovery or Fuzzing Activity Detection

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

This detection rule identifies potential web server discovery or fuzzing activity. Attackers often employ automated tools to discover hidden or unlinked resources on a web server. This reconnaissance phase involves sending a high volume of HTTP GET requests, often resulting in 404 (Not Found) or 403 (Forbidden) status codes. The rule focuses on identifying a single source IP address generating a large number of such requests within a defined timeframe. The targeted web servers can be running Nginx, Apache, Apache Tomcat, IIS, or Traefik. Detecting this activity early can prevent more targeted attacks by identifying and blocking malicious sources before they discover sensitive information or vulnerabilities. This proactive approach helps maintain the security and integrity of web applications and infrastructure.

Attack Chain

Initial Reconnaissance: The attacker begins by identifying potential target web servers.
Tool Selection: The attacker chooses a web server discovery or fuzzing tool.
Request Generation: The attacker uses the selected tool to generate a high volume of HTTP GET requests.
Resource Enumeration: The tool iterates through a list of potential resource paths and sends GET requests to each.
Status Code Analysis: The attacker analyzes the HTTP response codes to identify resources that return 404 or 403 status codes, indicating non-existent or forbidden paths.
Discovery of Hidden Resources: The attacker identifies potentially vulnerable or misconfigured resources based on the responses.
Targeted Exploitation: The attacker focuses on the discovered resources, attempting to exploit vulnerabilities or gain unauthorized access.
Impact: Successful exploitation can lead to data breaches, system compromise, or other malicious activities.

Impact

Successful web server discovery and fuzzing can lead to the identification of sensitive files, misconfigured directories, and exploitable vulnerabilities. While this rule is rated as low severity, successful reconnaissance paves the way for more severe attacks. Exploitation of discovered vulnerabilities could lead to data breaches, unauthorized access, and denial-of-service attacks. The number of victims can vary depending on the scale and nature of the targeted web application. Sectors commonly targeted include e-commerce, banking, and government.

Recommendation

Deploy the Sigma rule Web Server Fuzzing Activity - High Volume to your SIEM to detect suspicious IP addresses generating a high number of 404/403 responses (rule definition below).
Review web server logs for anomalies and unexpected 404/403 responses, focusing on the IP addresses flagged by the Web Server Fuzzing Activity - High Volume rule.
Implement rate limiting on web servers to mitigate the impact of fuzzing attempts.
Monitor authentication logs for unusual patterns following the detection of web server fuzzing to catch potential exploitation attempts (related to the investigation steps).
Block identified malicious IP addresses at the firewall or WAF (based on source.ip in the rule definition).
Enable comprehensive web server logging, including request methods, URLs, and response codes, to enhance detection capabilities.

Web Server Discovery or Fuzzing Activity Detected

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This rule detects potential reconnaissance activity against web servers, specifically web server discovery or fuzzing. The activity is characterized by a single source IP address generating a high volume of HTTP GET requests that result in 404 (Not Found) or 403 (Forbidden) status codes within a short time period. The logic is based on analysis of web server logs from Nginx, Apache, Apache Tomcat, IIS, and Traefik. Such patterns typically indicate an attacker is trying to discover hidden or unlinked resources, potentially identifying vulnerabilities or sensitive information disclosure points on the web server. This discovery phase can often precede more targeted attacks. The detection logic triggers when more than 500 events from a single source IP are observed, involving more than 250 distinct URL requests.

Attack Chain

The attacker initiates a connection to the target web server using an automated tool.
The attacker sends a large number of HTTP GET requests to the web server, probing various URLs and paths.
The web server responds to the requests, often returning 404 (Not Found) or 403 (Forbidden) status codes for non-existent or restricted resources.
The attacker analyzes the HTTP response codes to identify potentially accessible or vulnerable resources.
If accessible resources are found (e.g., administrative interfaces, backup files), the attacker attempts to access them.
The attacker may attempt further exploitation based on discovered vulnerabilities or accessible resources.
The attacker gains unauthorized access to the web server or sensitive data.
The attacker performs malicious activities such as data theft, defacement, or system compromise.

Impact

Successful web server discovery and fuzzing can lead to the identification of sensitive files (e.g., configuration files, backups), vulnerable endpoints (e.g., administrative interfaces), and insecure configurations. An attacker can leverage this information to gain unauthorized access, leading to data breaches, system compromise, or service disruption. The severity of the impact depends on the nature of the exposed resources and the attacker's capabilities.

Recommendation

Deploy the Sigma rule Web Server Fuzzing Detection to your SIEM and tune the threshold based on your environment's baseline traffic to reduce false positives.
Review web server logs for patterns matching the description in the Overview to identify potential attackers.
Implement rate limiting on your web servers and WAF to mitigate the impact of web server discovery and fuzzing attempts, based on the analysis of http.request.method and http.response.status_code.
Ensure that sensitive files and directories are properly secured and not publicly accessible, reviewing access control configurations on the web server.
Monitor web server logs for requests to common sensitive paths (e.g., /.env, /.git, /admin), using a rule targeting the url.original field, to detect unauthorized access attempts.

Web Server Discovery or Fuzzing Activity

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This detection identifies web server reconnaissance and fuzzing attempts. The rule is triggered when a single source IP address generates a high volume of HTTP GET requests that result in 404 (Not Found) or 403 (Forbidden) status codes within a short period. This behavior suggests an attacker is trying to discover hidden or unlinked resources on a web server, a common initial step before more targeted attacks. This is achieved by counting events and distinct URLs accessed from logs across Nginx, Apache, Apache Tomcat, IIS, and Traefik web servers. The rule triggers if more than 500 events and 250 distinct URLs are observed from a single IP address within the monitored timeframe.

Attack Chain

The attacker initiates network connections to a target web server (Nginx, Apache, etc.).
The attacker sends a series of HTTP GET requests to various URLs, often using a wordlist.
The web server processes each request and returns HTTP status codes.
The attacker analyzes the HTTP status codes to identify existing resources.
A large number of 404 (Not Found) or 403 (Forbidden) responses indicate a fuzzing attempt.
The attacker identifies potentially vulnerable or misconfigured resources.
The attacker may attempt to exploit discovered vulnerabilities.
Successful exploitation could lead to information disclosure or unauthorized access.

Impact

Successful web server discovery enables attackers to map out a web application's structure and identify potential vulnerabilities or misconfigurations. This reconnaissance can precede more severe attacks, such as unauthorized access to sensitive data, code execution, or denial-of-service attacks. While this rule has low severity, successful reconnaissance can lead to high impact outcomes.

Recommendation

Deploy the Sigma rule High Volume of 404/403 GET Requests to your SIEM and tune the threshold (events > 500 and URLs > 250) for your environment.
Investigate any alerts generated by the Sigma rule to identify the source IP address and the target web server, then check the associated logs.
Review WAF/CDN logs for rate limiting and blocks related to the suspicious source IP, as recommended in the overview.
Implement rate limiting on web servers to mitigate the impact of web server discovery and fuzzing attempts, as mentioned in the overview.
Harden the web tier by disabling directory listing and default app endpoints, blocking patterns like /.git/, /.env, and /backup.zip at the WAF, and restricting origin access to CDN egress only, as mentioned in the overview.