Shulou(Shulou.com)05/31 Report--

This article will explain in detail how to make Tomcat stronger. The editor thinks it is very practical, so I share it with you as a reference. I hope you can get something after reading this article.

Tomcat server is a free and open source Web application server, is a lightweight application server, is the first choice to develop and debug JSP programs, it is highly sought after by developers, in web security testing often encounter tomcat sites, here through the combination of tomcat several common configuration loopholes, talk about its reinforcement recommendations, to create a stronger tomcat.

NO 1 unsafe http request method

1 vulnerability description

The system supports multiple http request methods, as shown in figure 1

Figure 1

2 reinforcement scheme

1) to solve this problem, modify the web.xml file of tomcat and add the following content to the web.xml file:

2) restart the tomcat service after modification. The details of the modified web.xml are as follows:

Figure 1

3) after modification, check the options request method again and prompt 403. The error message is shown in figure 2.

Figure 2

NO 2 slow dos attack

1 vulnerability description

The vulnerability of slow dos attack is to make the server wait, which maliciously consumes the server resources while the server is keeping the connection waiting.

2 reinforcement suggestions

Modify the server.xml file. Connectiontimeout defaults to 20000ms, and here it is changed to 5000ms, which can effectively alleviate the problem. (this parameter means that when a link is established, if neither fin nor data is received from the client, the connection will be released after waiting for 20 seconds.) when trying to test an attack with slowhttptest, the prompt is as follows

NO 3 directory file listing vulnerability

1 vulnerability description

Tomcat 8.0 is automatically masked to list directory files, and allows files to be listed when it is true in web.xml, as shown in figure 1

Figure 1

2 reinforcement suggestions

When false, avoid listing catalog files, as shown in figure 2

Figure 2

NO 4 default management path for sensitive information disclosure

1 vulnerability description

Tomcat has a default administrative path and is at risk of being blown up by a malicious attacker.

2 reinforcement suggestions

First, modify tomcat default port 8080, modify web.xml, and change the default port to 9999, as shown in figure 1.

Figure 1

Just restart the tomcat service, as shown in figure 2

Figure 2

NO 5 undefined error page for sensitive information disclosure

1 vulnerability description

When the system reports an error, the error message will reveal some sensitive information, and sub-define the error page to reduce the leakage of sensitive information, as shown in figure 1

Figure 1

2 reinforcement suggestions

Modify the web.xml file and add the following error page prompt, as shown in figure 1

Figure 1

Create a new error.html under the webapps/ROOT directory, which is a custom error page. When tomcat reports an error again, the custom error message is displayed, as shown in figure 2.

Figure 2

Version number disclosure of NO 6 sensitive information disclosure

1 vulnerability description

In the test system, it will be found that the error page of the system will disclose the tomcat version information, as shown in figure 1 below.

Figure 1

2 reinforcement suggestions

Go to the tomcat/lib directory and find catalina.jar. You can use the winrar file to open it, enter the\ org\ apache\ catalina\ util directory, and edit the ServerInfo.properties file, as shown in figure 1.

Figure 1

Modify the last three lines here to read as follows, as shown in figure 2

Figure 2

After the modification, save the content, update the jar package, restart the tomcat service. When the system reports an error, the prompt message is shown in figure 3, which hides the Tomcat version information.

Figure 3

NO 7 War package automatic deployment

1 Project description

In order to increase tomcat security, it is recommended to turn off the automatic deployment of war packages to prevent attackers from uploading malicious scripts.

2 configuration scheme

Modify the conf/server.xml file. UnpackWARs and unpackWars default to true, and here it is changed to false, as shown in figure 1.

Figure 1

Finally, open the tomcat log, you can monitor user access at any time, when there are security problems in the system, it is convenient to trace the source. To modify the server.xml file under conf, the default log file is placed under logs, directory: modify the default storage location, prefix: modify the log name prefix, suffix: log name suffix, pattern: the specific content of the log to be saved. You can adjust the log format according to the actual situation.

This is the end of the article on "how to make Tomcat stronger". I hope the above content can be of some help to you, so that you can learn more knowledge. if you think the article is good, please share it for more people to see.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.