Scribd Logo
Upload

Welcome to Scribd!

  • 74 views

    Hacking Weblogic

    Uploaded by

    Taha Sanabani
    This document outlines how attackers can exploit default passwords in unsecured WebLogic server installations to gain unauthorized access. It explains that WebLogic servers often have weak default credentials still enabled, allowing easy access to the administration console. From there, attackers can deploy backdoored web applications with privileges to execute system commands on the server. The document provides recommendations for securing WebLogic, such as changing default passwords and disabling unnecessary features.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Hacking Weblogic

    Uploaded by

    Taha Sanabani
    74 views7 pages
    This document outlines how attackers can exploit default passwords in unsecured WebLogic server installations to gain unauthorized access. It explains that WebLogic servers often have weak default credentials still enabled, allowing easy access to the administration console. From there, attackers can deploy backdoored web applications with privileges to execute system commands on the server. The document provides recommendations for securing WebLogic, such as changing default passwords and disabling unnecessary features.

    Original Title

    hacking-weblogic

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document outlines how attackers can exploit default passwords in unsecured WebLogic server installations to gain unauthorized access. It explains that WebLogic servers often have weak default credentials still enabled, allowing easy access to the administration console. From there, attackers can deploy backdoored web applications with privileges to execute system commands on the server. The document provides recommendations for securing WebLogic, such as changing default passwords and disabling unnecessary features.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    74 views7 pages

    Hacking Weblogic

    Uploaded by

    Taha Sanabani
    This document outlines how attackers can exploit default passwords in unsecured WebLogic server installations to gain unauthorized access. It explains that WebLogic servers often have weak default credentials still enabled, allowing easy access to the administration console. From there, attackers can deploy backdoored web applications with privileges to execute system commands on the server. The document provides recommendations for securing WebLogic, such as changing default passwords and disabling unnecessary features.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 7

    We provide to a client a comprehensive Website Security Report, outlining security threats

    and current set of measures taken to prevent these threats, alongside with practical
    recommendation how to increase the security of the website.
    Http://www.sysmox.com

    Page: 1
    Table of Contents:

    1 Introduction …………………….……………2
    2 Web logic …………………………………….2
    3 Default installation…………………………...3
    3.1 The web application………………………..4
    3.2 deploy it ……………………………………5
    3.3 Backdooring the weblogic………………….6
    4 Securing……………………………...….….7

    1. Introduction:
    Brief paper about how attackers can use the default password to hack the weblogic.

    1.2 Weblogic :
    Owned by Oracle Corporation, Oracle WebLogic consists of a Java EE platform product-
    family that includes:

    a Java EE application server, WebLogic Application Server


    an enterprise portal, WebLogic Portal
    an Enterprise Application Integration platform
    a transaction server and infrastructure, WebLogic Tuxedo
    a telecommunication platform, WebLogic Communication Platform
    an HTTP web server

    Page: 2
    2. Default installation :
    A moderately high number of weblogic server keep the default password during the
    instalation . it is quite easy for an hacker to enter to the weblogic console and gain access to
    privat and sensitive information and data center ,This attack can be used for hackers in
    diferent ways .
    Most WebLogic Administration Console start witht the default password:

    Username : weblogic and the default Password is weblogic. Attacker need just to browse
    bLogic Server is http://hostname:port, where hostname is the name of the server where
    WebLogic is installed and port is the WebLogic port number (by default, 7001).

    Http://localhost:7001/console

    Hackers can use different way to get list of web server running weblogics .

    Page: 3
    Here are list of default passwords:

    http://cirt.net/passwords?criteria=weblogic

    Into the console:

    3.1 The web application:


    In order to deploy a web application via console:

    Deploy = web application modules = Deploy a new Web Application Module...


    upload your file(s) Deploy

    Page: 4
    In Web Application Modules :
    A Web application on WebLogic Server includes the following files:

     At least one servlet or JSP, along with any helper classes.


     A web.xml deployment descriptor, a J2EE standard XML document that describes the
    contents of a WAR file.
     Optionally, a weblogic.xml deployment descriptor, an XML document containing
    WebLogic Server-specific elements for Web applications.
     A Web application can also include HTML and XML pages with supporting files such
    as images and multimedia files.

    3.2 .Deploy it:


    Attacker can upload a backdoor.war

    Page: 5
    It is necessary to create a WAR file with WEB-INF a JSP to execute system commands. The
    WAR file should be deployed and and run commands using the cmdshell.jsp. These
    commands will be executed with the privileges of the weblogic server.

    3.3 Backdooring the weblogic:


    Here is a short example

    Attackers can use different scanner to get weblogic server as google dork

    Page: 6
    4 .Securing the weblogic:
    http://download.oracle.com/docs/cd/E12890_01/ales/docs32/integrateappenviron/configWLS.
    html#wp1099454

    The main mission of sysmox is to conduct researches of different application and system
    vulnerabilities. The result of this work is then used by the experts of the sysmox Security
    audit department for assessing the security level of information systems with the use of active
    audit methods and also while carrying out penetration tests .

    Http://www.sysmox.com

    Page: 7

    You might also like