XAMPP’s convenience makes it the easiest to recognize.
The problems occur when:
1. XAMPP is left running on web-accessible machines.
2. There is an attempt to use it for an application that is not local.
3. There is no hardening of XAMPP before being deployed.
4. Running tests and demoing XAMPP and forgetting about it.
Attackers do not have to exploit XAMPP.
They begin by locating the XAMPP installation itself.
What are the things that allow an attacker to identify XAMPP.
XAMPP does provide “fingerprints” that allow for the easy identification:
1. Default Path & URL
2. Header & Response Structures
3. Admin Control Panel URLs
4. Directory Structure
These indicators (fingerprints) exist across the versions of XAMPP.
Primary Indicators for Attackers Searching for XAMPP
Attackers will probe for the following XAMPP server paths to locate a running XAMPP service:
1. /xampp/
2. /phpmyadmin/
3. /dashboard/
4. /security/
5. /licenses/
For example, a manual way to find a XAMPP installation would be:
curl http://target.com/xampp/
The above command will return the XAMPP dashboard if it is available.
HTTP Headers and Server Signatures
The following are HTTP headers and server signatures typically exposed by XAMPP:
1. Apache default banners
2. PHP version disclosures
3. OS hints (Windows or Linux)
Example:
curl -I http://target.com
Responses containing Apache/2.x (Win64) combined with PHP are strong indicators.
Automated Discovery Tools
Nmap Service Fingerprinting
Service fingerprinting is the method attackers use to identify services instead of guessing.
nmap -sV -p 80,443 [Target.com]
As the result of this scan you will see:
1. Apache Version
2. PHP Handler
3. OS Fingerprints
The combination of XAMPP installations usually corresponds with a known combination of Apache and PHP.
Nikto (Passive Discovery)
The common xampp directory entries will be flagged by Nikto:
nikto -h http://[Target.com]
Examples of those entries could be:
1. phpmyadmin exposed
2. XAMPP directories exposed
3. Default files in place
When implementing a defensive strategy against XAMPP infections, this should be performed prior to an outside attack.
Shodan and Internet Scanners
Search strings used by attackers:
title:"XAMPP Apache + MariaDB"
or
phpmyadmin
As a result of these types of searches, attackers will discover multiple thousands of development stacks exposed on the internet.
phpMyAdmin: The Loudest Noise
If you can reach /phpmyadmin:
1. XAMPP exists
2. There is a potential to access the associated database
3. If so, the attacker will typically try to brute-force the database password
Example test:
curl http://[Target.com]/phpmyadmin/
If present at all, the mere presence of a login page demonstrates the existence of XAMPP.
JavaScript and Static Files
Any XAMPP dashboards will help you find:
1. Unique Js Filenames
2. CSS Pathways Pointing To XAMPP
3. Key indicators of local setups (comments)
Attackers often check any download and third-party assets:
grep -R "xampp" ./site-files
This is a silent and low risk reconnaissance effort.
Configuration Files Exposed
Servers that are incorrectly configured may expose:
1. .ini
2. .log
3. .bak
4. .old
Example:
curl http://[Target.com]/phpinfo.php
The exposure of phpinfo gives the attacker an understanding of:
1. File Paths of the Site
2. All modules and programs installed
3. Operating System and Type
4. Where the XAMPP Installation is located
The Procedure of Carrying Out a Realistic Attack
1. Scan IP ranges for Apache+PHP servers
2. Look for /xampp/ and /phpmyadmin/ on these servers
3. Verify the confirmation page of the XAMPP application
4. Determine the installed OS and PHP version on the server
5. Search for weak passwords or security vulnerabilities; do not start trying to exploit at this point.
The Reason This Class of Attack Remains Undetected
1. All traffic will appear to be that of standard web browsing (http)
2. No brute force attempts need to be made
3. There is no malware involved
4. Server logs will not show any indication of abnormal activity
All of this makes discovery very difficult.
What the Defensive Teams Should Do
1. Block all access to the /xampp/ folder
2. Restrict access to phpMyAdmin to only the localhost interface
3. Disable all directory listings in the webserver configuration
4. Remove the installation of XAMPP after development is complete
5. Monitor for frequent requests to these known paths
XAMPP should never be exposed to the internet.
Conclusions
1. There are unique fingerprints associated with XAMPP installations
2. Identifying a XAMPP installation is quick and easy to do
3. Default installation paths are the primary tip-off for identifying a XAMPP installation
4. Exposing phpMyAdmin is a serious warning sign
5. Discovery occurs prior to exploitation in many cases
In most situations, discovering a compromised XAMPP server results from simple visibility, not because of a sophisticated attack vector.
