Please enable JavaScript.

Coggle requires JavaScript to display documents.

to/from HTTP Client, HTTP_CORE (main functionality), HTTP_CORE (main…

- - - - authn_file_module (static)
        authn_default_module (static)
        authz_host_module (static)
        authz_groupfile_module (static)
        authz_user_module (static)
        authz_default_module (static)
        auth_basic_module (static)
    - - mod_proxy
        
        CVE-2021-40438
        
        A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
        
        Proof of Concept > noExploit
        
        CVE-2019-0211
    - - offers you to protect Apache against Brute Force or DDoS attacks.
    - - offers HTTPS for Apache.
    - - allows for matching url patterns with regular expressions, and perform a transparent redirect using .htaccess tricks, or apply a HTTP status code response.
    - - that allows you to monitor Apache web server load and page statics.
        scoreboard infos are used by mod_status to provide current server statistics in a human readable form.
      - apache2ctl status
        
        _ — The server is waiting for the connection.
        S — The server is starting.
        R — The server is reading the request.
        W — The server is sending a reply.
        K — The server is in keep-alive (read) mode.
        D — The server received a DNS request.
        C — The server is closing the connection.
        I — Idle worker cleanup.
        . — Idle worker.
    - - uses a single control process which is responsible for launching child processes.
      - at ccertain circumstances when ressource capacity and websites complexity go high go high >> the Multi-Processing Modules (MPM) Prefork module might be in order
      - Exploits / Vulns
        
        CVE-2019-0211
        
        Context
        
        in predork , the main server process running as roor manages the a pool of single threaded low provilege www-data worker processes meant to handle http requests
        In order to get feedback from its workers, Apache maintains a shared-memory area (SHM), scoreboard, which contains various informations such as the workers PIDs and the last request they handled. Each worker is meant to maintain a process_score structure associated with its PID, and has full read/write access to the SHM.
        
        Exploit Steps
        
        Await for the scheduledTime to get an arbitrary function call
        
        Make all+bucket point to the structure
        
        obtain R/W access on a worker process
        
        write a fake prefork_child_bucket structure in the SHM
    - - implements a hybrid multi-process multi-threaded server. By using threads to serve requests, it is able to serve a large number of requests with fewer system resources than a process-based server.
      - The most important directives used to control this MPM are ThreadsPerChild, which controls the number of threads deployed by each child process and MaxRequestWorkers, which controls the maximum total number of threads that may be launched.
    - - allow more requests to be served simultaneously by passing off some processing work to the listeners threads, freeing up the worker threads to serve new requests.
        event is based on the worker MPM
- - - - Handlers are defined by the modules depending on when they are needed to fulfill a request then the Handlers are the ones that send back the processing from the Apache Module to the Apache Core HTTP_REQUEST component in order to be sent to another module or back to the client.