Two novel server-side attacks against log file in Shared Web Hosting servers

Shared Web Hosting service enables hosting multitude of websites on a single powerful server. It is a well-known solution as many people share the overall cost of server maintenance and also, website owners do not need to deal with administration issues is not necessary for website owners. In this paper, we illustrate how shared web hosting service works and demonstrate the security weaknesses rise due to the lack of proper isolation between different websites, hosted on the same server. We exhibit two new server-side attacks against the log file whose objectives are revealing information of other hosted websites which are considered to be private and arranging other complex attacks. In the absence of isolated log files among websites, an attacker controlling a website can inspect and manipulate contents of the log file. These attacks enable an attacker to disclose file and directory structure of other websites and launch other sorts of attacks. Finally, we propose several countermeasures to secure shared web hosting servers against the two attacks subsequent to the separation of log files for each website.

• Publication year

  2012

• Venue

  International Conference for Internet Technology and Secured Transactions

• Publication date

  2012-12-01

• Fields of study

  Computer Science

• Identifiers
  arXiv 1811.00923
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Performance Evaluation of Shared Hosting Security Methods

  2012cited by this paper
• Abusing locality in shared web hosting

  2011cited by this paper
• Why Johnny Can't Pentest: An Analysis of Black-Box Web Vulnerability Scanners

  2010cited by this paper

• Log Poisoning Attacks in IoT: Methodologies, Evasion, Detection, Mitigation, and Criticality Analysis

  2024cites this paper
• Sharing is Caring: Towards Analyzing Attack Surfaces on Shared Hosting Providers

  2024cites this paper
• Entangled Clouds: Measuring the Hosting Infrastructure of the Free Contents Web

  2023cites this paper
• The Infrastructure Utilization of Free Contents Websites Reveal their Security Characteristics

  2023cites this paper
• An Internet Hosted Website Detection Method Based on Network Behavior Analysis for Power Grid Enterprises

  2019cites this paper
• The Role of Hosting Providers in Web Security: Understanding and Improving Security Incentives and Performance via Analysis of Large-scale Incident Data

  2018cites this paper
• Herding Vulnerable Cats: A Statistical Approach to Disentangle Joint Responsibility for Web Security in Shared Hosting

  2017cites this paper
• Sniper: A framework for detecting attack attempts to open source web applications at the run time

  2014cites this paper
• A Comprehensive Approach to Abusing Locality in Shared Web Hosting Servers

  2013cites this paper