Testing for Web Application Fingerprint (OWASP-IG-004) - Revision history

Eduardo Castellanos Najera: Removed desenmascara.me since it is no longer relevant.

2015-12-02T11:12:48Z

Removed desenmascara.me since it is no longer relevant.

Amro Ahmed at 10:13, 21 September 2013

2013-09-21T10:13:34Z

Amro Ahmed at 10:12, 21 September 2013

2013-09-21T10:12:09Z

Amro Ahmed at 09:04, 21 September 2013

2013-09-21T09:04:19Z

Amro Ahmed at 08:18, 21 September 2013

2013-09-21T08:18:57Z

Amro Ahmed at 08:16, 21 September 2013

2013-09-21T08:16:30Z

Amro Ahmed at 07:29, 21 September 2013

2013-09-21T07:29:14Z

Andrew Muller at 13:03, 21 July 2013

2013-07-21T13:03:06Z

Emilio Casbas at 14:49, 27 June 2013

2013-06-27T14:49:41Z

Amro Ahmed at 14:11, 17 February 2013

2013-02-17T14:11:47Z

@@ Line 270: / Line 270: @@
 * httprecon - http://www.computec.ch/projekte/httprecon/
 * Netcraft - http://www.netcraft.com
 * Shodan - http://www.shodanhq.com
 * Nmap - http://nmap.org

@@ Line 271: / Line 271: @@
 * Netcraft - http://www.netcraft.com
 * Desenmascarame - http://desenmascara.me
-* Shodan -
+* Shodan - http://www.shodanhq.com
 * Nmap - http://nmap.org

@@ Line 271: / Line 271: @@
 * Netcraft - http://www.netcraft.com
 * Desenmascarame - http://desenmascara.me
 === Automated Testing ===
@@ Line 277: / Line 279: @@
 [[Image:httprint.jpg |800px|]]
 === Online Testing ===
@@ Line 300: / Line 316: @@
 * Saumil Shah: "An Introduction to HTTP fingerprinting" - http://www.net-square.com/httprint_paper.html
 * Anant Shrivastava : "Web Application Finger Printing" - http://anantshri.info/articles/web_app_finger_printing.html
 == Remediation ==

@@ Line 276: / Line 276: @@
 An example of running httprint is shown below:<br><br>
-[[Image:httprint.jpg]]
+[[Image:httprint.jpg |800px|]]
 === Online Testing ===
@@ Line 284: / Line 284: @@
 <br><br>
-[[Image:netcraft2.png]]
+[[Image:netcraft2.png |800px|]]
@@ Line 290: / Line 290: @@
 <br><br>

← Older revision		Revision as of 08:18, 21 September 2013
Line 290:		Line 290:
	<br><br>		<br><br>

−
−	~~[[File:Example.jpg]]~~

← Older revision	Revision as of 08:16, 21 September 2013
Line 291:	Line 291:


−	+	[[File:Example.jpg]]

@@ Line 279: / Line 279: @@
 === Online Testing ===
-Online tools can be used if the tester wishes to test more stealthily and doesn't wish to directly connect to the target website. An example of online tool that often delivers a lot of information on target Web Server, is [http://www.netcraft.com Netcraft]. With this tool we can retrieve information about operating system, web server used, Server Uptime, Netblock Owner, history of change related to Web server and O.S.<br>
+Online tools can be used if the tester wishes to test more stealthily and doesn't wish to directly connect to the target website. An example of online tool that often delivers a lot of information on target Web Server, are [http://www.netcraft.com Netcraft] and [http://www.shodanhq.com SHODAN]
 An example is shown below:
 <br><br>
 [[Image:netcraft2.png]]

@@ Line 1: / Line 1: @@
 {{Template:OWASP Testing Guide v4}}
-== Brief Summary ==
+== Summary ==
 Web server fingerprinting is a critical task for the Penetration tester. Knowing the version and type of a running web server allows testers to determine known vulnerabilities and the appropriate exploits to use during testing.
 There are several different vendors and versions of web servers on the market today. Knowing the type of web server that you are testing significantly helps in the testing process, and will also change the course of the test. This information can be derived by sending the web server specific commands and analyzing the output, as each version of web server software may respond differently to these commands. By knowing how each type of web server responds to specific commands and keeping this information in a web server fingerprint database, a penetration tester can send these commands to the web server, analyze the response, and compare it to the database of known signatures. Please note that it usually takes several different commands to accurately identify the web server, as different versions may react similarly to the same command. Rarely, however, different versions react the same to all HTTP commands. So, by sending several different commands, you increase the accuracy of your guess.
-== Black Box testing and example ==
+== Test Objectives ==
 The simplest and most basic form of identifying a Web server is to look at the Server field in the HTTP response header. For our experiments we use netcat.
 Consider the following HTTP Request-Response:
@@ Line 91: / Line 94: @@
 In this case, the server field of that response is obfuscated: we cannot know what type of web server is running.
-=== Protocol behaviour ===
+==== Protocol behaviour ====
 More refined techniques take in consideration various characteristics of the several web servers available on the market. We will list some methodologies that allow us to deduce the type of web server in use.
@@ Line 262: / Line 265: @@
 </BODY></HTML>
 </pre>
 === Automated Testing ===
-The tests to carry out in order to accurately fingerprint a web server can be many. Luckily, there are tools that automate these tests. "''httprint''" is one of such tools. httprint has a signature dictionary that allows one to recognize the type and the version of the web server in use.<br>
+Rather than rely on manual bannering and analysis of the web server headers, a tester can use automated tools to achieve the same purpose. The tests to carry out in order to accurately fingerprint a web server can be many. Luckily, there are tools that automate these tests. "''httprint''" is one of such tools. httprint has a signature dictionary that allows one to recognize the type and the version of the web server in use.<br>
 An example of running httprint is shown below:<br><br>
 [[Image:httprint.jpg]]
-=== OnLine Testing ===
+=== Online Testing ===
-An example of on line tool that often delivers a lot of information on target Web Server, is Netcraft. With this tool we can retrieve information about operating system, web server used, Server Uptime, Netblock Owner, history of change related to Web server and O.S.<br>
+Online tools can be used if the tester wishes to test more stealthily and doesn't wish to directly connect to the target website. An example of online tool that often delivers a lot of information on target Web Server, is [http://www.netcraft.com Netcraft]. With this tool we can retrieve information about operating system, web server used, Server Uptime, Netblock Owner, history of change related to Web server and O.S.<br>
 An example is shown below:
 <br><br>
@@ Line 280: / Line 289: @@
 While this project is being developed, you can test a [http://desenmascara.me/ Spanish Proof of Concept of this idea].
-== References ==
+== Vulnerability References ==
 '''Whitepapers'''<br>
 * Saumil Shah: "An Introduction to HTTP fingerprinting" - http://www.net-square.com/httprint_paper.html
 * Anant Shrivastava : "Web Application Finger Printing" - http://anantshri.info/articles/web_app_finger_printing.html
-'''Tools'''<br>
-* httprint - http://net-square.com/httprint.html
+== Remediation ==
-* httprecon - http://www.computec.ch/projekte/httprecon/
-* Netcraft - http://www.netcraft.com
+Protect the presentation layer web server behind a hardened reverse proxy.
-* Desenmascarame - http://desenmascara.me