Web-metadata

CALL FOR CONTRIBUTORS: If you would like collaborate in this project join with us.

Collection of HTTP and HTML metadata information in order to categorize its relevance as a sign of possible security weakness or signs of hardening in any website. The final goal is to raise web security awareness (assessing favourably the signs of hardening and assessing negatively the signs of weakness) with an overall interpretation of this information from any website.

Examples of Metadata assessing

Weakness signs	Hardening signs
MetaGenerator[Joomla! 1.5	X-Frame-Options[SAMEORIGIN
Microsoft-IIS/6.0	X-XSS-Protection
Apache/2.2.22(Unix) mod_ssl/2.2.22 OpenSSL/0.9.8e-fips-rhel5	UncommonHeaders[x-varnish

Proof of concept in Spanish

---

This information collected plus more input from other OWASP projects as Top 10 2013-Top 10, could serve as the basis for WEB fingerprinting. A proof of concept tool is available in as a web service.

Server HTTP header metadata collected

Server HTTP header	Description	More information
AkamaiGHost	Web server using Akamai Global Hosting	Need references
AmazonS3	Web server using Amazon cloud	Common Response headers
Apache/X.X	Web server using Apache technology	Technology lider in Internet
Microsoft-IIS/X	Web server using Microsoft IIS technology	How to modify this header
PWS	Small Microsoft Web server for old Windows versions	Microsoft Personal Web Server
nginx/X.X	Russian web server and reverse proxy	Official site
lighttpd/X.X	Web server optimized for speed-critical environments	Official site
OpenCms/X.X	Open source content management system written in Java	Official site
Netscape-Enterprise/X.X	Web server using old Netscape technology	Current server family
Sun-ONE-Web-Server/X	Web server using iPlanet web server technology	Current server family
Oracle-Application-Server-Xx	Web server using Oracle applications server	Official site
Lotus-Domino	Web server using IBM Lotus Domino technology	Official site
Sun-Java-System-Web-Server/X	Web server using Oracle iPlanet technology	Official site
Oracle-iPlanet-Web-Server/7.0	Web server using Oracle iPlanet technology	iPlanet Web server
IBM_HTTP_Server/X.X	Web server using IBM technology (Apache based)	How to hide version
LiteSpeed/X.X	Web server using LiteSpeed technology (Apache based)	How to hide version
Alterian-CME/X.X	Web server using SDL ACM	SDL acquires Alterian
Tengine	Web server using Tengine technology (nginx based)	Need more information
eZ Publish	Web server using EZ technology	Open Source CMS
GSE	Web server using Google infrastructure (blogger)	Need more information
gws	Web server using Google infrastructure (search pages)	Need more information
sffe	Web server using Google infrastructure (static files)	Need more information
tfe	Web server using Twitter infrastructure	Need more information
YTS	Web server using Yahoo! infrastructure	Need more information
cloudflare-nginx	Web server using CloudFlare infrastructure	Need more information

Powered-by HTTP header metadata collected (this header isn't an HTTP standard)

Powered-by HTTP header	Description	More information
eBD/3.5.5	Web server using EBD technology	Need more info
eWAY	Web server using eWay payment gateway	Need more info
Express	Web server using nodejs with express	x-powered-by Enables the "X-Powered-By: Express" HTTP header, enabled by default.
PHP/x.x	Web server using PHP technology	How to remove header
ASP.NET	Web server using Microsoft ASP technology	Custom headers
Servlet/X.X JSP/X.X	Web server using Tomcat application server	Header implementation
Plesklin	Web server using Parallels technology	How to disable header
(mod_rails/mod_rack)	Web server using Ruby on Rails technology	Phusion Passenger
ARR/X.X	Web server using IIS with request routing technology	More header information
JSF/2.0	Web server using JavaServer Faces technology	Need more info

Uncommon HTTP headers collected (this headers aren't an HTTP standard)

Custom HTTP headers	Description	More information
access-control-allow-origin, access-control-allow-headers	Web server using HTTP access control (CORS)	Need more info
x-generator	Web server running under Drupal	function _drupal_default_html_head
x-amz-	Web server running under Amazon services	common response headers
x-cache-hits,x-timer,x-served-by, x-varnish, x-varnish-cache	Web server using Varnish cache technology	How to modify this header
x-drupal-cache	Web server using Drupal technology	Vulnerabilities stats
x-dynatrace	Web server using dynatrace technology	Need more data
x-server-name	Web server using Websphere technology	node HTTP headers
strict-transport-security	opt-in security enhancement that is specified by a web application	HTTP Strict Transport Security

HTML metadata / HTTP headers collected which could allow fingerprinting

HTML metadata	Description	More information
moodle	Web server using Moodle technology	Vulnerabilities stats
MetaGenerator[Sitefinity	Web server using SiteFinity technology	Security based on ASP.NET model
HTTPServer[BigIP / Cookies[BIGip	Web server using F5 technology	Need more info
Cookies: PHPSESSID	Web server using PHP technology	Session cookie
Cookies: JSESSIONID	Web server using JSP technology	Session cookie
Cookies: ASPSESSION	Web server using ASP technology	See ASP.NET in the Powered-by HTTP header section
Cookies: fe_typo_user	Web server using TYPO3 technology	Ref
Cookies: CFID	Web server using Coldfusion technology	Need more data
Cookies: CFTOKEN	Web server using Coldfusion technology	Need more data
MetaGenerator[Square One, Meta-Author[Jeremy	Web server using Square One CMS (light version of Joomla)	Looks like is discontinued
MetaGenerator[LFC	Web server using LFS technology	CMS based on Python, Django and jQuery
MetaGenerator[Percussion	Web server using Percussion CMS	CMS for Marketers
RiOS[	Web server using Riverbeed WAN optimization Riverbeed WAN optimization	Riverbeed Technology

TODO: https://www.owasp.org/index.php/Fingerprint_Web_Application_(OTG-INFO-009)#Common_Application_Identifiers