Skip to main content

Application Reveals Webserver name and Version in HTTP Response Or WebServer Banner Not Masked

 Application Reveals Webserver name and Version in HTTP Response or WebServer Banner NOT Masked.

One of many security vulnerabilities that a web server faces is revealing webserver name and its version. Often hackers use this information understand the version and induce vulnerabilities applicable to a specific version.

Oracle Application's is one of the most affected as it uses a lower version of Apache web server on till 11i.

Following information can be seen either using iehttpdheaders for IE or yslow for mozilla.

HTTP/1.1 200 OK
Date: Mon, 26 Jul 2010 05:11:47 GMT
Server: Oracle HTTP Server Powered by Apache/1.3.19
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Keep-Alive: timeout=15
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=US-ASCII

Here if you notice it gives in a lot of information than it should.

To mask this banner set the following parameter in your httpd.conf file.

ServerTokens Prod


Once this parameter is set, the header will not display Apache version information.


HTTP/1.1 200 OK
Date: Mon, 26 Jul 2010 05:11:47 GMT
Server: Oracle HTTP Server Powered by Apache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Keep-Alive: timeout=15
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=US-ASCII


To know more about this parameter CLICK HERE


To entirely remove "Server" entry from the header

Add the following line at the end of httpd.conf file and restart Apache services.

ServerHeader Off

Once this is done check the header information using iehttpheaders,


 HTTP/1.1 404 Not Found
Cache-Control: private
Content-Type: text/html
Set-Cookie: JSESSIONID=2a7e464c4de0a32e4a6e8addb59919a8af244f235ecc37aa185866437ac9d56b.e3iOb3eMbheMe34Mb30MbxuSa3f0n6jAmljGr5XDqQLvpAe; path= Connection: Keep-Alive
Keep-Alive: timeout=5, max=999
Content-Length: 166
Date: Tue, 10 May 2011 08:02:09 GMT



Labels:

Comments

Post a Comment

Popular posts from this blog

Basics of RDBMS

Data Small set of information becomes data, this set of information helps make decision. Data is always some useful information. Database Place where you store the data. Database represents some aspect of the real world called "miniworld". A database is designed, built and populated with data for a specific purpose. It has intended group of users and some preconceived applications in which these users are interested. In other words, a database has some source from which data is derived, some degree of interaction with events in the real world and an audience that is actively interested in the contents of the database. Database can also be defined as collection of one or more tables. Ex: Mobile, human brain etc DBMS (Database Management System ) Is a program that stores retrieves and modifies data in the database on request. Study of different techniques of design, development and maintenance of the database Types of DBMS These types are based upon their m
102 comments
Read more

SQL Interview Questions on Subqueries

SUB Queries: 1. List the employees working in research department 2. List employees who are located in New York and Chicago 3. Display the department name in which ANALYSTS are working 4. Display employees who are reporting to JONES 5. Display all the employees who are reporting to Jones Manager 6. Display all the managers in SALES and ACCOUNTING department 7. Display all the employee names in Research and Sales Department who are having at least 1 person reporting to them 8. Display all employees who do not have any reportees 9. List employees who are having at least 2 reporting 10. List the department names which are having more than 5 employees 11. List department name having at-least 3 salesman 12. List employees from research and accounting having at-least 2 reporting 13. Display second max salary 14. Display 4th max salary 15. Display 5th max salary  -- Answer for nth Max Salary Co-Related Subqueries: 16. Write a query to get 4th max salary from EMP table 17. Wri
31 comments
Read more

Answers for SQL Functions

1. SQL> SELECT empno, ename FROM emp WHERE Length(ename) = 4; 2. SQL> SELECT empno, ename, job FROM emp where Length(job)=7; 3. SQL> SELECT Length('qspiders') - Length(replace('qspiders','s','')) FROM dual; 4. SQL>  SELECT empno, ename, job FROM emp WHERE Instr(job,'MAN') >0; 5. SQL> SELECT empno, ename, job FROM emp WHERE Instr(job, 'MAN') =1; 6. SQL> SELECT empno, ename, job FROM emp WHERE (Length(ename) - Length(Replace(ename, 'L',''))) = 1; 7. SQL> SELECT * FROM dept WHERE Instr(dname,'O') > 0; 8. SQL> SELECT Concat(ename,' working as a ') || Concat(job, ' earns ') || Concat(sal, '  in ') || Conc at('dept ',deptno) AS text from emp; OR SQL> SELECT Concat(Concat(Concat(Concat(Concat(Concat(Concat(ename,' working as a '), job),' earns '), sal),'  in '),'dept '), deptno) AS text FROM emp; 9. SQL
40 comments
Read more