prikaz prve stranice dokumenta Detekcija i mitigacija Apache napada simboličkim poveznicama
  Download
PDF 830.47 KB
undergraduate thesis
Detekcija i mitigacija Apache napada simboličkim poveznicama
2024. urn:nbn:hr:200:081013
Molnar, Josip
Josip Juraj Strossmayer University of Osijek
Faculty of Electrical Engineering, Computer Science and Information Technology Osijek
Department of Communications
Chair of Electronics and Microelectronics

Cite this document

Molnar, J. (2024). Detekcija i mitigacija Apache napada simboličkim poveznicama (Undergraduate thesis). Osijek: Josip Juraj Strossmayer University of Osijek, Faculty of Electrical Engineering, Computer Science and Information Technology Osijek. Retrieved from https://urn.nsk.hr/urn:nbn:hr:200:081013

Molnar, Josip. "Detekcija i mitigacija Apache napada simboličkim poveznicama." Undergraduate thesis, Josip Juraj Strossmayer University of Osijek, Faculty of Electrical Engineering, Computer Science and Information Technology Osijek, 2024. https://urn.nsk.hr/urn:nbn:hr:200:081013

Molnar, Josip. "Detekcija i mitigacija Apache napada simboličkim poveznicama." Undergraduate thesis, Josip Juraj Strossmayer University of Osijek, Faculty of Electrical Engineering, Computer Science and Information Technology Osijek, 2024. https://urn.nsk.hr/urn:nbn:hr:200:081013

Molnar, J. (2024). 'Detekcija i mitigacija Apache napada simboličkim poveznicama', Undergraduate thesis, Josip Juraj Strossmayer University of Osijek, Faculty of Electrical Engineering, Computer Science and Information Technology Osijek, accessed 22 January 2025, https://urn.nsk.hr/urn:nbn:hr:200:081013

Molnar J. Detekcija i mitigacija Apache napada simboličkim poveznicama [Undergraduate thesis]. Osijek: Josip Juraj Strossmayer University of Osijek, Faculty of Electrical Engineering, Computer Science and Information Technology Osijek; 2024 [cited 2025 January 22] Available at: https://urn.nsk.hr/urn:nbn:hr:200:081013

J. Molnar, "Detekcija i mitigacija Apache napada simboličkim poveznicama", Undergraduate thesis, Josip Juraj Strossmayer University of Osijek, Faculty of Electrical Engineering, Computer Science and Information Technology Osijek, Osijek, 2024. Available at: https://urn.nsk.hr/urn:nbn:hr:200:081013

Please login to the repository to save this object to your list.
Metadata
TitleDetekcija i mitigacija Apache napada simboličkim poveznicama
Title (english)Detection and mitigation of Apache symbolic link attacks
AuthorJosip Molnar
MentorMarijan Herceg (mentor)
Committee memberMarijan Herceg (predsjednik povjerenstva)
Committee memberRatko Grbić (član povjerenstva)
Committee memberDenis Vranješ (član povjerenstva)
GranterJosip Juraj Strossmayer University of Osijek
Faculty of Electrical Engineering, Computer Science and Information Technology Osijek
(Department of Communications)
(Chair of Electronics and Microelectronics)
Osijek
Defense date and country2024-10-03, Croatia
Scientific / art field,
discipline and subdiscipline		TECHNICAL SCIENCES
Electrical Engineering
Telecommunications and Informatics
Abstract
U ovom radu dan je pregled najčešćih sigurnosnih problema u web hosting okruženjima, s fokusom na raširenu vrstu napada koji iskorištava ranjivosti u načinu na koji Apache web poslužitelj radi sa symlinkovima. Detaljno su obrazloženi: utjecaj ovakvih napada na poslužitelje koji koriste upravljačke ploče poput cPanela, ograničenja u prevenciji ovih napada, važnost brzine njihovog otkrivanja, i postupak mitigacije proizašle štete. Skripta foxhound.sh je izrađena s ciljem pravodobne detekcije ovih incidenata i jednostavne masovne implementacije na floti poslužitelja. Ova skripta traži symlinkove unutar početnih direktorija stranica na poslužitelju, vrši jednostavnu analizu rezultata i obavještava administratora ukoliko se incident dogodio. Također je izrađena skripta foxdie.sh, namijenjena automatizaciji procesa resetiranja zaporki za pristup bazama podataka kompromitiranih web aplikacija, zaporki njihovih administratorskih računa, te ažuriranju relevantnih konfiguracijskih datoteka. Korištenjem ove skripte uvelike se ubrzava postupak prevencije daljnjeg neovlaštenog pristupa kompromitiranim aplikacijama, te shodno tome i smanjuje šteta vlasnicima poslužitelja i stranica
Abstract (english)
This paper provides an overview of the most common security issues present in web hosting environments, with a focus on a widespread attack that exploits the way that the Apache web server handles symlinks. It provides a detailed explanation of how these attacks affect servers that utilize control panel software such as cPanel, the limitations of symlink attack prevention, the importance of quick detection of such attacks, as well as the process of mitigating the resulting damage. The foxhound.sh bash script was created with the goals of timely detection of such attacks and easy deployment on a fleet of servers. It searches for symlinks within the document roots of the websites present on the server, performs a simple analysis of the results, and notifies the administrator if an incident is found to have occurred. The foxdie.sh script was created to automate the process of resetting the database user and CMS administrator passwords of compromised sites, as well as updating the pertinent configuration files. Using this script greatly speeds up the process of preventing further unauthorized access to compromised sites, and thus also reduces the damage done to the owners of the server and sites.
Keywords
Keywords (english)
Languagecroatian
URN:NBNurn:nbn:hr:200:081013
Study programmeTitle: Professional study programme of Electrical Engineering; specializations in: Power Engineering, Automation, Informatics
Course: Power Engineering
Study programme type: professional
Study level: undergraduate
Academic / professional title: prvostupnik/prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka elektrotehnike (prvostupnik/prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka elektrotehnike)
Type of resourceText
File originBorn digital
Access conditionsOpen access
Terms of useLicence In copyright icon
Created on2024-10-29 12:28:29