Website monitoringWebsite monitoring is an automated process of checking availability of a site.
Website monitoring is an automated process of checking availability of a site. The main goal of it is evaluation of possibility to access the site by clients. It is clear, that a site is efficient when an interested person can load the page and make a purchase or look for some information. If this action fails for some reason - the site does not execute its mission, and a client will find what he needs somewhere else.
There are many solutions of this problems, and all of them could be divided into passive and active ways. The result of monitoring is the value of uptime, measured with some accuracy. Having it, one can conclude how long is the site broken during some period of time (usually, for a year). Low uptime usually means that the server where the site is hosted, or internet connection to it, is unreliable and is required to be changed.
Considering the recently discovered Shellshock vulnerability, HostTracker has created a tool for testing it.
How does it work?
It is developed for a Linux server with a web server installed on it. The algorithm is very simple. We consequently generate 4 http requests:
1. Ordinary request
2. The request tries, using vulneratility, post a "harmful" cookie which causes 2-seconds delay in respond to our special http request.
3. The request tries, using vulneratility, post a "harmful" cookie which causes 4-seconds delay in respond to our special http request.
4. Same as #3
How to understand the result?
We compare response time for all 4 requests. Three situation are possible:
1. Vulnerability found. We may affirm that if the difference in responses is about 2 seconds for requests without cookie and with 2-second-delay cookie, as well as for requests with 2 and 4-second delay cookie. It means that our request was able to use the vulnerability and set these cookies.
2. Vulnerability not found. All the requests have about the same response time. The cookies, likely, were not installed because there is no vulnerability.
3. Uncertain situation. If the response time differs widely, without coincidence with preset by cookies delay, we can not say for sure. It could be if the server is under high load. To check this, we use two requests with same cookies (#3 and #4). If the response time for two same checks varies, we make a conclusion that the response time is not affected by cookies. At least, not only by them. So in this case our method can not detect vulnerability
Safety of checks
Our test can not damage your server. The risk consists of appearance of one extra-cookie, which is used only for our requests and can not affect normal work-flow of your site.