Fingerprint Web Server (OTG-INFO-002) - Revision history

Eduardo Castellanos Najera: Removed desenmascara.me since it is no longer relevant.

2015-12-02T11:11:26Z

Removed desenmascara.me since it is no longer relevant.

Jane O'Connor: Added Andrew's changes.

2014-08-01T18:21:36Z

Added Andrew's changes.

Jane O'Connor: Final edit

2014-05-13T10:02:37Z

Final edit

Rick.mitchell: /* Protocol behaviour */

2014-04-01T13:35:50Z

‎Protocol behaviour

Rick.mitchell: /* Summary */

2014-04-01T13:33:31Z

‎Summary

Davide Danelon at 17:46, 4 March 2014

2014-03-04T17:46:10Z

Rick.mitchell: /* Online Testing */ - Minor clarifications

2013-10-01T16:13:33Z

‎Online Testing: - Minor clarifications

Rick.mitchell: /* Automated Testing */ - Minor clarification.

2013-10-01T16:11:44Z

‎Automated Testing: - Minor clarification.

Rick.mitchell: /* Black Box testing and example */ - Minor clarification.

2013-10-01T16:09:41Z

‎Black Box testing and example: - Minor clarification.

Andrew Muller at 13:02, 28 July 2013

2013-07-28T13:02:59Z

Show changes

← Older revision		Revision as of 11:11, 2 December 2015
Line 285:		Line 285:
	* httprecon - http://www.computec.ch/projekte/httprecon/		* httprecon - http://www.computec.ch/projekte/httprecon/
	* Netcraft - http://www.netcraft.com		* Netcraft - http://www.netcraft.com
−	* Desenmascarame - http://desenmascara.me

@@ Line 309: / Line 309: @@
-== Vulnerability References ==
+== References ==
 '''Whitepapers'''<br>
 * Saumil Shah: "An Introduction to HTTP fingerprinting" - http://www.net-square.com/httprint_paper.html

@@ Line 2: / Line 2: @@
 == Summary ==
-Web server fingerprinting is a critical task for the Penetration tester. Knowing the version and type of a running web server allows testers to determine known vulnerabilities and the appropriate exploits to use during testing.
+Web server fingerprinting is a critical task for the penetration tester. Knowing the version and type of a running web server allows testers to determine known vulnerabilities and the appropriate exploits to use during testing.
 == Test Objectives ==
 Find the version and type of a running web server to determine known vulnerabilities and the appropriate exploits to use during testing.
 == How to Test ==
-=== Black Box testing and example ===
+=== Black Box testing ===
-The simplest and most basic form of identifying a Web server is to look at the Server field in the HTTP response header. For our experiments we use netcat.
+The simplest and most basic form of identifying a web server is to look at the Server field in the HTTP response header. Netcat is used in this experiment.
 Consider the following HTTP Request-Response:
 <pre>
@@ Line 29: / Line 34: @@
 </pre>
-From the ''Server'' field, we understand that the server is likely Apache, version 1.3.3, running on Linux operating system.
 Four examples of the HTTP response headers are shown below.
@@ Line 83: / Line 89: @@
 Connection: close
 </pre>
 However, this testing methodology is limited in accuracy. There are several techniques that allow a web site to obfuscate or to modify the server banner string.
-For example we could obtain the following answer:
 <pre>
 HTTP/1.1 Forbidden
@@ Line 93: / Line 100: @@
 </pre>
-==== Protocol behaviour ====
+In this case, the server field of that response is obfuscated. The tester cannot know what type of web server is running based on such information.
-More refined techniques take in consideration various characteristics of the several web servers available on the market. We will list some methodologies that allow us to deduce the type of web server in use.
 '''HTTP header field ordering'''
-The first method consists of observing the ordering of the several headers in the response. Every web server has an inner ordering of the header. We consider the following answers as an example:
+The first method consists of observing the ordering of the several headers in the response. Every web server has an inner ordering of the header. Consider the following answers as an example:
 Response from '''Apache 1.3.23'''
@@ Line 160: / Line 169: @@
 Connection: close
 </pre>
 We can notice that the ordering of the ''Date'' field and the ''Server'' field differs between Apache, Netscape Enterprise, and IIS.
 '''Malformed requests test'''
@@ Line 218: / Line 229: @@
 Connection: close
 </pre>
 We notice that every server answers in a different way. The answer also differs in the version of the server. Similar observations can be done we create requests with a non-existent HTTP method/verb. Consider the following responses:
@@ Line 266: / Line 279: @@
 </BODY></HTML>
 </pre>
 == Tools ==
@@ Line 272: / Line 286: @@
 * Netcraft - http://www.netcraft.com
 * Desenmascarame - http://desenmascara.me
 === Automated Testing ===
-Rather than rely on manual banner grabbing and analysis of the web server headers, a tester can use automated tools to achieve the same results. The tests to carryout in order to accurately fingerprint a web server can be many. Luckily, there are tools that automate these tests. "''httprint''" is one of such tools. httprint uses a signature dictionary that allows it to recognize the type and the version of the web server in use.<br>
+Rather than rely on manual banner grabbing and analysis of the web server headers, a tester can use automated tools to achieve the same results. There are many tests to carry out in order to accurately fingerprint a web server. Luckily, there are tools that automate these tests. "''httprint''" is one of such tools. httprint uses a signature dictionary that allows it to recognize the type and the version of the web server in use.<br>
 An example of running httprint is shown below:<br><br>
 [[Image:httprint.jpg]]
 === Online Testing ===
@@ Line 287: / Line 304: @@
-[[OWASP Unmaskme Project]] is expected to become another online tool to do fingerprinting of any website with an overall interpretation of all the [[Web-metadata]] extracted. The idea behind this project is that anyone in charge of a website could test the metadata their site is showing to the world and assess it from a security point of view.
+[[OWASP Unmaskme Project]] is expected to become another online tool to do fingerprinting of any website with an overall interpretation of all the [[Web-metadata]] extracted. The idea behind this project is that anyone in charge of a website could test the metadata the site is showing to the world and assess it from a security point of view.
 While this project is still being developed, you can test a [http://desenmascara.me/ Spanish Proof of Concept of this idea].
 == Vulnerability References ==
@@ Line 295: / Line 313: @@
 * Saumil Shah: "An Introduction to HTTP fingerprinting" - http://www.net-square.com/httprint_paper.html
 * Anant Shrivastava : "Web Application Finger Printing" - http://anantshri.info/articles/web_app_finger_printing.html
 == Remediation ==

@@ Line 218: / Line 218: @@
 Connection: close
 </pre>
-We notice that every server answers in a different way. The answer also differs in the version of the server. Similar observations can be done we create requests with a non-existent protocol. Consider the following responses:
+We notice that every server answers in a different way. The answer also differs in the version of the server. Similar observations can be done we create requests with a non-existent HTTP method/verb. Consider the following responses:
 Response from '''Apache 1.3.23'''

@@ Line 4: / Line 4: @@
 Web server fingerprinting is a critical task for the Penetration tester. Knowing the version and type of a running web server allows testers to determine known vulnerabilities and the appropriate exploits to use during testing.
-There are several different vendors and versions of web servers on the market today. Knowing the type of web server that you are testing significantly helps in the testing process, and will also change the course of the test. This information can be derived by sending the web server specific commands and analyzing the output, as each version of web server software may respond differently to these commands. By knowing how each type of web server responds to specific commands and keeping this information in a web server fingerprint database, a penetration tester can send these commands to the web server, analyze the response, and compare it to the database of known signatures. Please note that it usually takes several different commands to accurately identify the web server, as different versions may react similarly to the same command. Rarely, however, different versions react the same to all HTTP commands. So, by sending several different commands, you increase the accuracy of your guess.
+There are several different vendors and versions of web servers on the market today. Knowing the type of web server that you are testing significantly helps in the testing process, and can also change the course of the test. This information can be derived by sending the web server specific commands and analyzing the output, as each version of web server software may respond differently to these commands. By knowing how each type of web server responds to specific commands and keeping this information in a web server fingerprint database, a penetration tester can send these commands to the web server, analyze the response, and compare it to the database of known signatures. Please note that it usually takes several different commands to accurately identify the web server, as different versions may react similarly to the same command. Rarely, however, different versions react the same to all HTTP commands. So, by sending several different commands, you increase the accuracy of your guess.
 == Test Objectives ==

← Older revision		Revision as of 17:46, 4 March 2014
Line 7:		Line 7:

	== Test Objectives ==		== Test Objectives ==
		+	Find the version and type of a running web server to determine known vulnerabilities and the appropriate exploits to use during testing.

	== How to Test ==		== How to Test ==

@@ Line 279: / Line 279: @@
 === Online Testing ===
-Online tools can be used if the tester wishes to test more stealthily and doesn't wish to directly connect to the target website. An example of online tool that often delivers a lot of information on target Web Server, is [http://www.netcraft.com Netcraft]. With this tool we can retrieve information about operating system, web server used, Server Uptime, Netblock Owner, history of change related to Web server and O.S.<br>
+Online tools can be used if the tester wishes to test more stealthily and doesn't wish to directly connect to the target website. An example of an online tool that often delivers a lot of information about target Web Servers, is [http://www.netcraft.com Netcraft]. With this tool we can retrieve information about operating system, web server used, Server Uptime, Netblock Owner, history of change related to Web server and O.S.<br>
 An example is shown below:
 <br><br>
@@ Line 286: / Line 286: @@
-[[OWASP Unmaskme Project]] expect becomes another online tool to do fingerprinting in any website with an overall interpretation of all the [[Web-metadata]] extracted. The idea behind this project is that anyone in charge of a website could test the metadata their site is showing to the world and assess it from a security point of view.
+[[OWASP Unmaskme Project]] is expected to become another online tool to do fingerprinting of any website with an overall interpretation of all the [[Web-metadata]] extracted. The idea behind this project is that anyone in charge of a website could test the metadata their site is showing to the world and assess it from a security point of view.
 While this project is being developed, you can test a [http://desenmascara.me/ Spanish Proof of Concept of this idea].
 == Vulnerability References ==

@@ Line 82: / Line 82: @@
 Connection: close
 </pre>
-However, this testing methodology is not so good. There are several techniques that allow a web site to obfuscate or to modify the server banner string.
+However, this testing methodology is limited in accuracy. There are several techniques that allow a web site to obfuscate or to modify the server banner string.
 For example we could obtain the following answer:
 <pre>
@@ Line 92: / Line 92: @@
 </pre>
-In this case, the server field of that response is obfuscated: we cannot know what type of web server is running.
+In this case, the server field of that response is obfuscated: we cannot know what type of web server is running based on such information.
 ==== Protocol behaviour ====