How to counter or fix banner grabbing vulnerability

Question

During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.

I think it'd help to provide a little more information. What's a "banner grabbing finding"? What, exactly, did the audit report say? What research have you already done into this question?

Eric G · Answer 1 · 2012-09-03 16:29:49Z

As D.W. said above, some clarification would help, I assume this is a finding from an external scan? If so, there are a few options

Accept the finding. I imagine this is is rated low, even if you disable the banner at a login or change your HTTP responses to now show or lie about the web server, there is still lots of activities that can be performed to fingerprint the server based on traffic, error messages, file types being served, other services on the network. etc.
Change the server information returned per Gaurav's response above. ServerMask is a commerical tool to hide this type of information.
Throw up a proxy from incoming requests which will strip out this information, a lot of proxies will also reformat the HTTP headers which remove some of the information used to fingerprint a web server (e.g., on IIS this header comes before another, or Apache always formats it this way).

Interesting reads related to this:

Gaurav Kumar · Answer 2 · 2012-09-02 01:58:48Z

up vote 2 down vote

For IIS, you can use IISLockdown and for Apache you can set ServerSignature to Off (more info here)

answered Sep 2 '12 at 1:58

Gaurav Kumar
1713

2 Answers