3

When pentesting it is useful to know when apache mod_rewrite is enabled. But when one comes across a web server that does not utilize PHP it is difficult to tell if mod_rewrite is enabled considering that URL redirection isn't very necessary. Is there any way to tell if it is enabled (remotely) without simply guessing common URL redirections?

Bhubhu Hbuhdbus
  • 405
  • 1
  • 6
  • 13
  • "When pentesting it is useful to know when apache mod_rewrite is enabled". Could you clarify where this comes from? Ideally, a well-configured mod_rewrite (especially in the rewrite, not redirect sense) shouldn't be detectable: it should only affect the internal dispatch of the request, shouldn't it? – Bruno May 01 '12 at 20:24
  • Exploits that rely on mod_rewrite being enabled like www.securityfocus.com/bid/19204. One ideally wouldn't want to run such an exploit during a pentest unless you were sure mod_rewrite was enabled. – Bhubhu Hbuhdbus May 01 '12 at 20:37
  • Agreed. If they didn't leave the version string in the responses (eg: ServerSignature Off ServerTokens Prod) or mod_status enabled you shouldn't be able to tell. – adric May 01 '12 at 20:38
  • Ah yes, but that's more of a mod_rewrite implementation bug than a problem with the fact that mod_rewrite and its features are used. This could happen to any piece of software. The fact that mod_rewrite is enabled isn't a problem, is it? (The fact that a buggy version of it is used is.) – Bruno May 01 '12 at 20:40
  • Yes but in the case that a buggy version of it is used, mod_rewrite needs to nonetheless be enabled. – Bhubhu Hbuhdbus May 01 '12 at 20:43

1 Answers1

1

You might be able to test for poorly configured mod_rewrite configurations.

  • Metasploit Proxy Bypass Scanner
  • Metasploit LDAP BO
  • w3af has a bug that doesn't handle mod-rewrite properly, so you can end up leveraging the bug to fuzz a site to determine if it has mod_rewrite enabled

Of course, these are probes that only work if mod_rewrite exists and is unpatched and configured in a certain way.

Otherwise, I'm not sure if one could detect what is supposed to be transparent...

schroeder
  • 129,372
  • 55
  • 299
  • 340