Detecting load balancers

When performing a penetration test there is the possibility that vulnerabilities left open on one server are not available on another. Proper load balancing will be almost completely transparent which could easily lead to miscommunication of the testing results if you find any server issues on a server that is part of a pool.

Tip

We are focusing on HTTP load balancing for these exercises. Detecting DNS load balancing can be done by using your enumeration tools described in a previous chapter. For instance, you could use dig to see if multiple servers are returned for the same domain name.

Quick reality check – Load Balance Detector

BackTrack 5 includes a script named Load Balance Detector (lbd.sh) that will quickly test for load balancing. Running this tool against our current balanced Kioptrix3.com server will provide you with input that the server is not load balanced because the tool never gets a chance to see the other server.

However, if you edit your HAProxy configuration...