This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Web-metadata"

From OWASP
Jump to: navigation, search
 
(15 intermediate revisions by the same user not shown)
Line 29: Line 29:
 
|'''Description'''
 
|'''Description'''
 
|'''More information'''
 
|'''More information'''
 +
|-
 +
|AkamaiGHost
 +
|Web server using Akamai Global Hosting
 +
|Need references
 +
|-
 +
|AmazonS3
 +
|Web server using Amazon cloud
 +
|[http://docs.aws.amazon.com/AmazonS3/latest/API/RESTCommonResponseHeaders.html Common Response headers]
 
|-
 
|-
 
|Apache/X.X
 
|Apache/X.X
Line 128: Line 136:
 
|'''Description'''
 
|'''Description'''
 
|'''More information'''
 
|'''More information'''
 +
|-
 +
|eBD/3.5.5
 +
|Web server using [http://www.ebdsoft.com/ EBD technology]
 +
|Need more info
 +
|-
 +
|eWAY
 +
|Web server using [http://www.eway.com.au/ eWay payment gateway]
 +
|[http://www.eway.com.au Need more info]
 +
|-
 +
|Express
 +
|Web server using [http://expressjs.com/api.html nodejs with express]
 +
|[http://expressjs.com/api.html x-powered-by Enables the "X-Powered-By: Express" HTTP header, enabled by default.]
 
|-
 
|-
 
|PHP/x.x
 
|PHP/x.x
Line 159: Line 179:
  
 
{| class="wikitable" style="text-align: center; "
 
{| class="wikitable" style="text-align: center; "
−
|+ '''HTML metadata collected which could allow [https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Fingerprinting fingerprinting] '''
+
|+ '''[http://en.wikipedia.org/wiki/List_of_HTTP_header_fields Uncommon HTTP headers] collected (this headers aren't an HTTP standard)'''
 +
|'''Custom HTTP headers'''
 +
|'''Description'''
 +
|'''More information'''
 +
|-
 +
|access-control-allow-origin, access-control-allow-headers
 +
|Web server using [https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS HTTP access control (CORS)]
 +
|Need more info
 +
|-
 +
|x-generator
 +
|Web server running under Drupal
 +
|[https://api.drupal.org/api/drupal/includes!common.inc/function/_drupal_default_html_head/7 function _drupal_default_html_head]
 +
|-
 +
|x-amz-
 +
|Web server running under Amazon services
 +
|[http://docs.aws.amazon.com/AmazonS3/latest/API/RESTCommonResponseHeaders.html common response headers]
 +
|-
 +
|x-cache-hits,x-timer,x-served-by, x-varnish, x-varnish-cache
 +
|Web server using [https://www.varnish-cache.org/ Varnish cache technology]
 +
|[http://blogs.technet.com/b/stefan_gossner/archive/2008/03/12/iis-7-how-to-send-a-custom-server-http-header.aspx How to modify this header]
 +
|-
 +
|x-drupal-cache
 +
|Web server using [https://drupal.org/ Drupal technology]
 +
|[http://www.cvedetails.com/product/2387/Drupal-Drupal.html?vendor_id=1367 Vulnerabilities stats]
 +
|-
 +
|x-dynatrace
 +
|Web server using [http://www.compuware.com/en_us/application-performance-management.html dynatrace technology]
 +
|Need more data
 +
|-
 +
|x-server-name
 +
|Web server using [http://www-01.ibm.com/software/websphere/ Websphere technology]
 +
|[http://publib.boulder.ibm.com/infocenter/wmbhelp/v6r1m0/index.jsp?topic=%2Fcom.ibm.etools.mft.doc%2Fac00477_.htm node HTTP headers]
 +
|-
 +
|strict-transport-security
 +
|opt-in security enhancement that is specified by a web application
 +
|[https://www.owasp.org/index.php/HTTP_Strict_Transport_Security HTTP Strict Transport Security]
 +
|}
 +
 
 +
 
 +
{| class="wikitable" style="text-align: center; "
 +
|+ '''HTML metadata / HTTP headers collected which could allow [https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Fingerprinting fingerprinting] '''
 
|'''HTML metadata'''
 
|'''HTML metadata'''
 
|'''Description'''
 
|'''Description'''
Line 168: Line 228:
 
|[http://www.cvedetails.com/vendor/2105/Moodle.html Vulnerabilities stats]
 
|[http://www.cvedetails.com/vendor/2105/Moodle.html Vulnerabilities stats]
 
|-
 
|-
−
|x-cache-hits,x-timer,x-served-by, x-varnish, x-varnish-cache
+
|MetaGenerator[Infopark CMS Fiona
−
|Web server using [https://www.varnish-cache.org/ Varnish cache technology]
+
|Web server using [https://www.infopark.de/produkte/CMS-Fiona CMS Fiona technology]
−
|[http://blogs.technet.com/b/stefan_gossner/archive/2008/03/12/iis-7-how-to-send-a-custom-server-http-header.aspx How to modify this header]
+
|6.10 Last version. Need more info.
 
|-
 
|-
 
|MetaGenerator[Sitefinity
 
|MetaGenerator[Sitefinity
Line 180: Line 240:
 
|Need more info
 
|Need more info
 
|-
 
|-
−
|x-drupal-cache
+
|Cookies: PHPSESSID
−
|Web server using [https://drupal.org/ Drupal technology]
 
−
|[http://www.cvedetails.com/product/2387/Drupal-Drupal.html?vendor_id=1367 Vulnerabilities stats]
 
−
|-
 
−
|Cookies[PHPSESSID
 
 
|Web server using [http://php.net/ PHP technology]
 
|Web server using [http://php.net/ PHP technology]
 
|[http://php.net/manual/en/function.session-start.php Session cookie]
 
|[http://php.net/manual/en/function.session-start.php Session cookie]
 
|-
 
|-
−
|Cookies[JSESSIONID
+
|Cookies: JSESSIONID
 
|Web server using [http://en.wikipedia.org/wiki/JavaServer_Pages JSP technology]
 
|Web server using [http://en.wikipedia.org/wiki/JavaServer_Pages JSP technology]
 
|[http://blog.whitehatsec.com/tag/jsessionid/#.UcxS4PnOuSp Session cookie]
 
|[http://blog.whitehatsec.com/tag/jsessionid/#.UcxS4PnOuSp Session cookie]
 
|-
 
|-
−
|Cookies[ASPSESSION
+
|Cookies: ASPSESSION
 
|Web server using [http://www.asp.net/ ASP technology]
 
|Web server using [http://www.asp.net/ ASP technology]
 
|See ASP.NET in the Powered-by HTTP header section
 
|See ASP.NET in the Powered-by HTTP header section
 
|-
 
|-
−
|Cookies[fe_typo_user
+
|Cookies: fe_typo_user
 
|Web server using [http://typo3.org/ TYPO3 technology]
 
|Web server using [http://typo3.org/ TYPO3 technology]
 
|[http://cookiepedia.co.uk/cookies/fe_typo_user Ref]
 
|[http://cookiepedia.co.uk/cookies/fe_typo_user Ref]
 
|-
 
|-
−
|x-server-name
+
|Cookies: CFID
−
|Web server using [http://www-01.ibm.com/software/websphere/ Websphere technology]
+
|Web server using [http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-7ffc.html Coldfusion technology]
−
|[http://publib.boulder.ibm.com/infocenter/wmbhelp/v6r1m0/index.jsp?topic=%2Fcom.ibm.etools.mft.doc%2Fac00477_.htm node HTTP headers]
+
|Need more data
 
|-
 
|-
−
|access-control-allow-origin, access-control-allow-headers
+
|Cookies: CFTOKEN
−
|Web server using [https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS HTTP access control (CORS)]
+
|Web server using [http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-7ffc.html Coldfusion technology]
−
|Need more info
+
|Need more data
 
|-
 
|-
 
|MetaGenerator[Square One, Meta-Author[Jeremy
 
|MetaGenerator[Square One, Meta-Author[Jeremy
Line 220: Line 276:
 
|CMS for Marketers
 
|CMS for Marketers
 
|-
 
|-
−
|RiOS[8.5.3a]
+
|RiOS[
 
|Web server using Riverbeed WAN optimization [http://www.riverbed.com/products/wan-optimization/ Riverbeed WAN optimization]
 
|Web server using Riverbeed WAN optimization [http://www.riverbed.com/products/wan-optimization/ Riverbeed WAN optimization]
−
|CMS for Marketers
+
|[http://en.wikipedia.org/wiki/Riverbed_Technology Riverbeed Technology]
 
|}
 
|}
  
 
TODO: https://www.owasp.org/index.php/Fingerprint_Web_Application_(OTG-INFO-009)#Common_Application_Identifiers
 
TODO: https://www.owasp.org/index.php/Fingerprint_Web_Application_(OTG-INFO-009)#Common_Application_Identifiers

Latest revision as of 14:28, 13 October 2014


Share this:  E-mail this story Bookmark with Facebook Share on Digg.com Share on delicious Share on reddit.com Share on stumbleupon.com Share on LinkedIn.com Share on twitter.com Seed on Newsvine

CALL FOR CONTRIBUTORS: If you would like collaborate in this project join with us.

Collection of HTTP and HTML metadata information in order to categorize its relevance as a sign of possible security weakness or signs of hardening in any website. The final goal is to raise web security awareness (assessing favourably the signs of hardening and assessing negatively the signs of weakness) with an overall interpretation of this information from any website.

Examples of Metadata assessing
Weakness signs Hardening signs
MetaGenerator[Joomla! 1.5 X-Frame-Options[SAMEORIGIN
Microsoft-IIS/6.0 X-XSS-Protection
Apache/2.2.22(Unix) mod_ssl/2.2.22 OpenSSL/0.9.8e-fips-rhel5 UncommonHeaders[x-varnish

Proof of concept in Spanish

This information collected plus more input from other OWASP projects as Top 10 2013-Top 10, could serve as the basis for WEB fingerprinting. A proof of concept tool is available in as a web service.

Server HTTP header metadata collected
Server HTTP header Description More information
AkamaiGHost Web server using Akamai Global Hosting Need references
AmazonS3 Web server using Amazon cloud Common Response headers
Apache/X.X Web server using Apache technology Technology lider in Internet
Microsoft-IIS/X Web server using Microsoft IIS technology How to modify this header
PWS Small Microsoft Web server for old Windows versions Microsoft Personal Web Server
nginx/X.X Russian web server and reverse proxy Official site
lighttpd/X.X Web server optimized for speed-critical environments Official site
OpenCms/X.X Open source content management system written in Java Official site
Netscape-Enterprise/X.X Web server using old Netscape technology Current server family
Sun-ONE-Web-Server/X Web server using iPlanet web server technology Current server family
Oracle-Application-Server-Xx Web server using Oracle applications server Official site
Lotus-Domino Web server using IBM Lotus Domino technology Official site
Sun-Java-System-Web-Server/X Web server using Oracle iPlanet technology Official site
Oracle-iPlanet-Web-Server/7.0 Web server using Oracle iPlanet technology iPlanet Web server
IBM_HTTP_Server/X.X Web server using IBM technology (Apache based) How to hide version
LiteSpeed/X.X Web server using LiteSpeed technology (Apache based) How to hide version
Alterian-CME/X.X Web server using SDL ACM SDL acquires Alterian
Tengine Web server using Tengine technology (nginx based) Need more information
eZ Publish Web server using EZ technology Open Source CMS
GSE Web server using Google infrastructure (blogger) Need more information
gws Web server using Google infrastructure (search pages) Need more information
sffe Web server using Google infrastructure (static files) Need more information
tfe Web server using Twitter infrastructure Need more information
YTS Web server using Yahoo! infrastructure Need more information
cloudflare-nginx Web server using CloudFlare infrastructure Need more information
Powered-by HTTP header metadata collected (this header isn't an HTTP standard)
Powered-by HTTP header Description More information
eBD/3.5.5 Web server using EBD technology Need more info
eWAY Web server using eWay payment gateway Need more info
Express Web server using nodejs with express x-powered-by Enables the "X-Powered-By: Express" HTTP header, enabled by default.
PHP/x.x Web server using PHP technology How to remove header
ASP.NET Web server using Microsoft ASP technology Custom headers
Servlet/X.X JSP/X.X Web server using Tomcat application server Header implementation
Plesklin Web server using Parallels technology How to disable header
(mod_rails/mod_rack) Web server using Ruby on Rails technology Phusion Passenger
ARR/X.X Web server using IIS with request routing technology More header information
JSF/2.0 Web server using JavaServer Faces technology Need more info
Uncommon HTTP headers collected (this headers aren't an HTTP standard)
Custom HTTP headers Description More information
access-control-allow-origin, access-control-allow-headers Web server using HTTP access control (CORS) Need more info
x-generator Web server running under Drupal function _drupal_default_html_head
x-amz- Web server running under Amazon services common response headers
x-cache-hits,x-timer,x-served-by, x-varnish, x-varnish-cache Web server using Varnish cache technology How to modify this header
x-drupal-cache Web server using Drupal technology Vulnerabilities stats
x-dynatrace Web server using dynatrace technology Need more data
x-server-name Web server using Websphere technology node HTTP headers
strict-transport-security opt-in security enhancement that is specified by a web application HTTP Strict Transport Security


HTML metadata / HTTP headers collected which could allow fingerprinting
HTML metadata Description More information
moodle Web server using Moodle technology Vulnerabilities stats
MetaGenerator[Infopark CMS Fiona Web server using CMS Fiona technology 6.10 Last version. Need more info.
MetaGenerator[Sitefinity Web server using SiteFinity technology Security based on ASP.NET model
HTTPServer[BigIP / Cookies[BIGip Web server using F5 technology Need more info
Cookies: PHPSESSID Web server using PHP technology Session cookie
Cookies: JSESSIONID Web server using JSP technology Session cookie
Cookies: ASPSESSION Web server using ASP technology See ASP.NET in the Powered-by HTTP header section
Cookies: fe_typo_user Web server using TYPO3 technology Ref
Cookies: CFID Web server using Coldfusion technology Need more data
Cookies: CFTOKEN Web server using Coldfusion technology Need more data
MetaGenerator[Square One, Meta-Author[Jeremy Web server using Square One CMS (light version of Joomla) Looks like is discontinued
MetaGenerator[LFC Web server using LFS technology CMS based on Python, Django and jQuery
MetaGenerator[Percussion Web server using Percussion CMS CMS for Marketers
RiOS[ Web server using Riverbeed WAN optimization Riverbeed WAN optimization Riverbeed Technology

TODO: https://www.owasp.org/index.php/Fingerprint_Web_Application_(OTG-INFO-009)#Common_Application_Identifiers

Retrieved from "https://wiki.owasp.org/index.php?title=Web-metadata&oldid=183589"