Is it useful to determine the name of the server software while doing a penetration test?

Question

Getting the name of the server software through netcat or curl or any other method, is really useful?

I mean, OS fingerprinting is useful in order to tailor an attack. For example with regard to OS command injection it's obviously important since command syntax is OS dependent. But if I know that a specific site has an Apache server, does that really matter? If so, can you explain it to me?

Answer 1

Like when doing car maintenance, when you know which constructor, you will take the right maintenance manual (Don't try to repair a Ford Granada with the manual of a Honda civic).

When trying to break a particular system, you will browse for known exploit that could help you for this particular system.

Every net servers (From Sendmail to Apache, with Samba, wuFTPd and all others) have a bunch of published exploits which let an attacker to execute arbitrary code by using previously discovered security failure. All critical failure are quickly patched and newer version are published...

If a server use Zebulorglub V2.0.1, don't try exploit concerning Zebulorglub V2.0.0 or older, but could try exploit working on V2.0.1 or higher...

(Nota: Zebulorglub is a dummy name;)

Answer 2

Server names may be useful, depending on what the name is. For example, if the server name is "db3", then its role is probably a database server, while if it's name is "dev1", then it's probably a development server. What does that tell you? It might tell you which one to attack first.

Alternately, if it contains a real domain name, then that might clue you in as to who owns the server, which might help focus your attack.

If the server's name is "galileo" or "sasquatch", that probably doesn't tell you anything at all.

Answer 3

Knowing the exact version of the web server (and application server and DBMS) helps you a lot when performing a test.

First and foremost, it helps you when checking for public exploits and vulnerabilities.
Let's look at a famous example: kingcope's killapache.pl. The script targets a specific vulnerability found in several versions of Apache HTTP Server, which was later fixed by the vendor.
If you knew the version of the web server on the target host, you could use the public exploit only if the version is known to be vulnerable and you wouldn't bother to test exploits made for, say, Microsoft IIS.

Furthermore, knowing the version of the web server allows you to make use of default resources (e.g. Apache's) and possibly exploit them.

The same principles apply to the application server and, even more, to the DBMS. Knowing the version of the database used by the target web application, for example, allows you to test using the correct SQL syntax right away.

Answer 4

It's considered one of the things to certainly test according to the owasp testing guide. If the server is advertising the version number, an attacker can reduce his scope of attacks significantly. Refer to https://www.owasp.org/index.php/Information_Leakage

Answer 5

Along with the Server header, there are other headers that can give valuable information, like X-Powered-By. This can help you to find out what framework/language was the site coded with. There are attack vectors only applicable to certain languages, so that gives you an idea of what attacks you can start with.

Answer 6

When thinking about a penetration test it is useful, but it depends upon the stage of the test. This would fall under the category of information gathering this phase is when you would be gathering information similar to this. This information can be used to compile a more complete look at an organizations infrastructure. If you discover an Apache server you now know which platform and hopefully version you will need to research for potential vulnerabilities.