Fingerprint Web Server (WSTG-INFO-02)
PreviousConduct Search Engine Discovery Reconnaissance for Information Leakage (WSTG-INFO-01)NextReview Webserver Metafiles for Information Leakage (WSTG-INFO-03)
Last updated
Last updated
WSTG-INFO-02
Web server fingerprinting is the task of identifying the type and version of web server that a target is running on. While web server fingerprinting is often encapsulated in automated testing tools, it is important for researchers to understand the fundamentals of how these tools attempt to identify software, and why this is useful.
Accurately discovering the type of web server that an application runs on can enable security testers to determine if the application is vulnerable to attack. In particular, servers running older versions of software without up-to-date security patches can be susceptible to known version-specific exploits.
Determine the version and type of a running web server to enable further discovery of any known vulnerabilities.
Techniques used for web server fingerprinting include , eliciting responses to malformed requests, and using automated tools to perform more robust scans that use a combination of tactics. The fundamental premise by which all these techniques operate is the same. They all strive to elicit some response from the web server which can then be compared to a database of known responses and behaviors, and thus matched to a known server type.
A banner grab is performed by sending an HTTP request to the web server and examining its . This can be accomplished using a variety of tools, including telnet for HTTP requests, or openssl for requests over TLS/SSL.
For example, here is the response to a request from an Apache server.
Here is another response, this time from nginx.
Here's what a response from lighttpd looks like.
In these examples, the server type and version is clearly exposed. However, security-conscious applications may obfuscate their server information by modifying the header. For example, here is an excerpt from the response to a request for a site with a modified header:
In cases where the server information is obscured, testers may guess the type of server based on the ordering of the header fields. Note that in the Apache example above, the fields follow this order:
Date
Server
Last-Modified
ETag
Accept-Ranges
Content-Length
Connection
Content-Type
However, in both the nginx and obscured server examples, the fields in common follow this order:
Server
Date
Content-Type
Testers can use this information to guess that the obscured server is nginx. However, considering that a number of different web servers may share the same field ordering and fields can be modified or removed, this method is not definite.
Web servers may be identified by examining their error responses, and in the cases where they have not been customized, their default error pages. One way to compel a server to present these is by sending intentionally incorrect or malformed requests.
For example, here is the response to a request for the non-existent method SANTA CLAUS from an Apache server.
Here is the response to the same request from nginx.
Here is the response to the same request from lighttpd.
As default error pages offer many differentiating factors between types of web servers, their examination can be an effective method for fingerprinting even when server header fields are obscured.
As stated earlier, web server fingerprinting is often included as a functionality of automated scanning tools. These tools are able to make requests similar to those demonstrated above, as well as send other more server-specific probes. Automated tools can compare responses from web servers much faster than manual testing, and utilize large databases of known responses to attempt server identification. For these reasons, automated tools are more likely to produce accurate results.
Here are some commonly-used scan tools that include web server fingerprinting functionality.
While exposed server information is not necessarily in itself a vulnerability, it is information that can assist attackers in exploiting other vulnerabilities that may exist. Exposed server information can also lead attackers to find version-specific server vulnerabilities that can be used to exploit unpatched servers. For this reason it is recommended that some precautions be taken. These actions include:
Ensuring that web servers are kept up-to-date with the latest software and security patches.
, an online tool that scans websites for information, including the web server.
, an Open Source command-line scanning tool.
, an Open Source command-line tool that also has a GUI, .
Obscuring web server information in headers, such as with Apache's .
Using a hardened to create an additional layer of security between the web server and the Internet.