👩‍💻 Attacking and defensing Nginx

Nginx, a popular web server and reverse proxy, is a critical component in many web infrastructures, making it a prime target for attacks. To secure Nginx, it’s crucial to apply best practices in configuration.

📌 Missing Root Location in Nginx Configuration:
- Explanation;
- The Missing Root Location Issue.

📌 Attack Scenario: Exploiting the Missing Root Location:
- Mitigating the Risk.

📌 Unsafe Path Restriction in Nginx:
- Explanation;
- Potential Bypass Techniques;
- Attack Scenario: Exploiting Path Restriction Bypass;
- Mitigation Strategies.

📌 Unsafe variable use / HTTP Request Splitting:
- Unsafe Use of Variables: $uri and $document_uri;
- Regex Vulnerabilities;
- Safe Configuration;
- Attack Scenarios and Detection Techniques;
- CRLF Injection and HTTP Request Splitting;
- Bypassing Path Restrictions Using Encoded Characters;
- Examples of Vulnerable Configurations.

📌 Raw Backend Response Reading:
- Example Scenario: Exposing Raw Backend Responses;
- Example uWSGI Application;
- Nginx Configuration;
- Example Invalid HTTP Request;
- Example Output for Invalid Request;
- Attack Scenario;
- Mitigation Strategies.

📌 merge_slashes set to off:
- merge_slashes Directive;
- Malicious Response Headers;
- map Directive Default Value;
- DNS Spoofing Vulnerability;
- proxy_pass and internal Directives.

📌 proxy_set_header Upgrade & Connection:
- Vulnerable Configuration;
- Vulnerability;
- Attack Scenario;
- Mitigation;
- Additional Attack Scenarios and Commands.

#hardening #web #linux