finding the apache log files using burp intruder

Often when conducting security assessments it is necessary to go beyond just identifying the vulnerability, reporting it and heading out for a beer. Sometimes, like when conducting a penetration test or when asked by a client to demonstrate business risk, it is necessary to gain command line line access to the machine to show the risks associated with having a web user being able to execute commands on their machine. Often this involves getting a shell by some means but in the case of Local File Inclusion (LFI) simply finding the Apache Log location folder can be enough to start running commands on the system as the Apache service account.

Often I’ve wasted hours trying all sorts of combinations trying to find the correct location of the log files by looking up version numbers and identifying operating systems but being the true to the Pentesters code, sometimes it’s better to be lazy and just automate the damn thing. So what a buddy of mine and me did was to compile a list of common Apache log file locations and files that may indicate Apache log locations across different operating systems. This list is by no means comprehensive and if the developer or engineer has bothered to spend 5 minutes moving the log file locations then chances are that this list may not help you.

Luckily, most people don’t bother moving logs which makes this a great list to work with. Below is an example of how to use this list to quickly discover the location of the Apache log location after you’ve located a LFI vulnerability.

This tutorial will utilize Burp Suite, one of the better Web Testing suites available. If you don’t have a copy yet, go get it from http://www.portswigger.net/burp/ The paid version of the software does not have the timing restrictions and is well worth getting to speed up this attack.

To start, copy the contents of this list and save it somewhere you can access through Burp Suite.

Once you have saved this list somewhere, open up Burp Suite, locate the LFI injection point and send the request to Burp Intruder.

In the Burp Intruder window, select the “Positions” tab and mark the position of your LFI injection point. Change the attack type to “Sniper”. Then under the “Payloads” tab, choose the Apache logs list or paste the contents of the list into the payload window.

Start the attack and pay attention to the length column. Typically Apache log folders are going to be large and should return a large length field.

When you find a length field that is significantly larger than the other requests, look at the response to see if the contents returned match what an Apache log file would look like. If it does look like a log file and you can see some of your previous traffic displayed, you have successfully found the Apache log location and can now use this to start injecting your PHP code to run requests on the target machine.

I will outline the steps to complete this in the next post.

Footnote: this log list is not comprehensive and I will continue to add to it as I find more more locations as well as some windows folder locations.