Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.

share|improve this question
I think it'd help to provide a little more information. What's a "banner grabbing finding"? What, exactly, did the audit report say? What research have you already done into this question? – D.W. Sep 2 '12 at 0:15

For IIS, you can use IISLockdown and for Apache you can set ServerSignature to Off (more info here)

share|improve this answer

As D.W. said above, some clarification would help, I assume this is a finding from an external scan? If so, there are a few options

  1. Accept the finding. I imagine this is is rated low, even if you disable the banner at a login or change your HTTP responses to now show or lie about the web server, there is still lots of activities that can be performed to fingerprint the server based on traffic, error messages, file types being served, other services on the network. etc.
  2. Change the server information returned per Gaurav's response above. ServerMask is a commerical tool to hide this type of information.
  3. Throw up a proxy from incoming requests which will strip out this information, a lot of proxies will also reformat the HTTP headers which remove some of the information used to fingerprint a web server (e.g., on IIS this header comes before another, or Apache always formats it this way).

Interesting reads related to this:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.