Show Posts
1
Tutorials / Fingerprinting Web Servers
« on: March 23, 2013, 08:02:41 pm »
I was asked to start a blog to give the public tutorials on security challenge sites (like securityoverride, smash the stack, etc) and this is one of them. I wrote it a day or so ago to help someone with a challenge on securityoverride.
-----
"Fingerprinting web servers is a technique for finding more information about the server for further testing. When I say fingerprinting, it's basically just identifying the server based around the information it gives you, allowing you to know what kind of software it is running."
Identifying VersionsWith simple requests to the server we can find out what software it is using. GET or POST requests will do. Requesting objects (files) that are not there or making requests for options that the server does (and does not) support are good places to start.
The above is an output of the netcat command and a GET request to a local server here. HTTP requests are case sensitive. The server tried to process the option head and found that there was none. However it does show us all the options it allows: GET, HEAD, POST, OPTIONS and TRACE. We now also know the software the server is running, Apache, and it's version, 2.2.1.7. The operating system and even some of the other software is also listed (PHP, ModSSL and OenSSL).
Using other methods supported by the server we can even get a listing (assuming there is not index file in place). Let's try the GET method.
I supplied an invalid version (aichi/6.6.6) and it still listed the directory contents, and yes, there was no index file. Let's see what it looks like with a blank index file.
-----
"Fingerprinting web servers is a technique for finding more information about the server for further testing. When I say fingerprinting, it's basically just identifying the server based around the information it gives you, allowing you to know what kind of software it is running."
Code: [Select]
http://aichi-ninja.blogspot.com/2013/03/fingerprinting-web-servers.html----Identifying VersionsWith simple requests to the server we can find out what software it is using. GET or POST requests will do. Requesting objects (files) that are not there or making requests for options that the server does (and does not) support are good places to start.
Code: [Select]
aichi@home# nc 127.0.0.1 81
head / http/1.0
HTTP/1.1 501 Method Not Implemented
Date: Fri, 22 Mar 2013 04:13:18 GMT
Server: Apache/2.2.17 (Win32) mod_ssl/2.2.17 OpenSSL/0.9.8q PHP/5.3.5
Allow: GET,HEAD,POST,OPTIONS,TRACE
Content-Length: 206
Connection: close
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>501 Method Not Implemented</title>
</head><body>
<h1>Method Not Implemented</h1>
<p>head to / not supported.<br />
</p>
</body></html> The above is an output of the netcat command and a GET request to a local server here. HTTP requests are case sensitive. The server tried to process the option head and found that there was none. However it does show us all the options it allows: GET, HEAD, POST, OPTIONS and TRACE. We now also know the software the server is running, Apache, and it's version, 2.2.1.7. The operating system and even some of the other software is also listed (PHP, ModSSL and OenSSL).
Code: [Select]
aichi@home# nc 127.0.0.1 81
HEAD / AICHI/6.6.6
HTTP/1.1 200 OK
Date: Fri, 22 Mar 2013 04:19:29 GMT
Server: Apache/2.2.17 (Win32) mod_ssl/2.2.17 OpenSSL/0.9.8q PHP/5.3.5
Connection: close
Content-Type: text/html;charset=UTF-8Using other methods supported by the server we can even get a listing (assuming there is not index file in place). Let's try the GET method.
Code: [Select]
aichi@home# nc 127.0.0.1 81
GET / AICHI/6.6.6
HTTP/1.1 200 OK
Date: Fri, 22 Mar 2013 04:23:28 GMT
Server: Apache/2.2.17 (Win32) mod_ssl/2.2.17 OpenSSL/0.9.8q PHP/5.3.5
Connection: close
Content-Type: text/html;charset=UTF-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html>
<head>
<title>Index of /</title>
</head>
<body>
<h1>Index of /</h1>
<table><tr><th><img src="/icons/blank.gif" alt="[ICO]"></th><th><a href="?C=N;O=D">Name</a></th><th><a href="?C=M;O=A">Last modified</a></th><th><a href="?C=S;O=A">Size</a></th><th><a href="?C=D;O=A">Description</a></th></tr><tr><th colspan="5"><hr></th></tr>
<tr><td valign="top"><img src="/icons/folder.gif" alt="[DIR]"></td><td><a href="0fees/">0fees/</a> </td><td align="right">12-Feb-2013 19:56 </td><td align="right"> - </td><td> </td></tr>
<tr><td valign="top"><img src="/icons/folder.gif" alt="[DIR]"></td><td><a href="ForwardElectric%20Backup/">ForwardElectric Backup/</a></td><td align="right">07-May-2012 08:31 </td><td align="right"> - </td><td> </td></tr> I supplied an invalid version (aichi/6.6.6) and it still listed the directory contents, and yes, there was no index file. Let's see what it looks like with a blank index file.