Fingerprinting a web server with httprecon

Web applications unfortunately are vulnerable and for this reason they are often the gateway for attacks. An attacker is going to perform reconnaissance to understand where a weakness may reside. Of course understand what web server platform is running is critical to understand what type attack may or may not be successful. In other word, knowing the application server one can then begin investigation into what vulnerabilities may exist.

There are a variety of tools and mechanisms you may employ to fingerprint your target. One such tool is httprecon and the user interface is very simple and provides a wealth of information. If you are not interested in installing software then Port80 Software has a number of tools that can be used all from a browser and one such tool is ServerMask. There are other online options to include NetCraft and Shodan. Finally is the tried and true Nmap.

nmap -sV www.somewhere.com

If you are running a Windows machine you can drop out to a command prompt and use telnet to perform banner grabbing. Be sure to enter the desired IP address and the appropriate port number.

telnet 127.0.0.1 80

At this stage you should see an empty command prompt with a flashing cursor. Go ahead and enter the following command and press enter twice.

HEAD / HTTP/1.0

The result is:

When it comes httprecon it works by sending out nine legitimate and not so legitimate requests.

Here I ran a request against a target of 127.0.0.1 which I will tell you now is a Windows Server 2012 instance.

List of Matches

HTTP Response Header

Timing Minimum: 0.082 seconds
Timing Maximum: 0.113 seconds
Timing Average: 0.091 seconds

Fingerprint Details ↑

I realize that I stated early on that the server was Windows Server 2012 and because of that bit of information it is true that the application server is Internet Information Services (IIS) 8.5, which can clearly be seen from the responses gathered by httprecon.

Obfuscate the HTTP Response

There are a number of ways to tackle the HTTP response and if you have an administrator that is unwilling or incapable, then the following example may be of use.

namespace ObfuscateHttpResponse {
public class ObfuscateHttpResponseModule : IHttpModule
 {
 public void Dispose() { }
 public void Init(HttpApplication context)
 {
 context.PreSendRequestHeaders += EditResponse;
 }
 void EditResponse(object sender, EventArgs e)
 {
 HttpContext.Current.Response.Headers.Set("Server", "Fingerprinting is not allowed!");
 }
 }
 }

Now all you need to do is jump over into the web.config and add this module.

<system.webServer>
 <modules>
 <addname="ObfuscateHttpResponseModule"type="ObfuscateHttpResponse.ObfuscateHttpResponseModule" />
 </modules>
</system.webServer>