Web Servers & Hosting Fundamentals

#Understanding Web Server Architecture#link

With a solid grasp of HTTP, HTML, and JavaScript, we now turn to the server side — the machines and software that actually process requests and serve content. Understanding web server architecture is essential for security professionals because server misconfigurations are among the most common and impactful vulnerabilities found in the wild.

What a Web Server Does

A web server is software that listens for incoming HTTP requests and responds with the appropriate content. At its simplest, a web server receives a request for a file, reads that file from disk, and sends it back. Modern web servers do much more — they handle SSL termination, load balancing, URL rewriting, authentication, and serve as reverse proxies for application servers.

Nginx Configuration Basics

Nginx is the most widely used web server today. Its configuration is organized into blocks (contexts) that define how requests are handled. Understanding Nginx config helps you identify misconfigurations during assessments.

server {
    listen 443 ssl http2;
    server_name www.example.com;
    
    ssl_certificate /etc/ssl/certs/example.com.pem;
    ssl_certificate_key /etc/ssl/private/example.com.key;
    
    # Serve static files directly
    location /static/ {
        alias /var/www/static/;
        expires 30d;
    }
    
    # Proxy API requests to application server
    location /api/ {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    
    # Default: serve SPA
    location / {
        try_files $uri $uri/ /index.html;
    }
}

Common Web Server Misconfigurations

Web server misconfigurations are a goldmine for attackers. Here are the most common and impactful ones:

• ▪Directory listing enabled — exposes file structure and sensitive files
• ▪Default credentials — admin panels with admin/admin passwords
• ▪Exposed server version headers — reveals software version for targeted exploits
• ▪Missing security headers — no CSP, HSTS, X-Frame-Options
• ▪Improper file permissions — world-readable configuration files
• ▪Unnecessary HTTP methods enabled — PUT, DELETE, TRACE allowed
• ▪Open proxy configuration — server can be used to attack other systems
• ▪Missing TLS/SSL — credentials and data transmitted in plaintext

Hosting Environments

Modern web applications are deployed in various environments, each with its own security considerations:

Cloud-Specific Risks: The Metadata Endpoint

One of the most critical cloud-specific attack vectors is the instance metadata endpoint. Cloud providers expose a local endpoint (169.254.169.254) that provides instance credentials and configuration. If an application is vulnerable to Server-Side Request Forgery (SSRF), an attacker can access this endpoint.

Server Headers and Information Disclosure

Web servers often reveal information through response headers that can aid an attacker. During reconnaissance, always examine these headers: