Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Getting the name of the server software through netcat or curl or any other method, is really useful?

I mean, OS fingerprinting is useful in order to tailor an attack. For example with regard to OS command injection it's obviously important since command syntax is OS dependent. But if I know that a specific site has an Apache server, does that really matter? If so, can you explain it to me?

share|improve this question
    
Do you mean the server name, or the name of the platform? OS fingerprinting suggests the name of the platform, but getting the server name implies the name of the server (ie hostname). I see answers below, each assuming you mean one or the other It would be hlpful to clarify so people can answer correctly. –  David Stratton Dec 31 '12 at 16:55

6 Answers 6

Like when doing car maintenance, when you know which constructor, you will take the right maintenance manual (Don't try to repair a Ford Granada with the manual of a Honda civic).

When trying to break a particular system, you will browse for known exploit that could help you for this particular system.

Every net servers (From Sendmail to Apache, with Samba, wuFTPd and all others) have a bunch of published exploits which let an attacker to execute arbitrary code by using previously discovered security failure. All critical failure are quickly patched and newer version are published...

If a server use Zebulorglub V2.0.1, don't try exploit concerning Zebulorglub V2.0.0 or older, but could try exploit working on V2.0.1 or higher...

(Nota: Zebulorglub is a dummy name;)

share|improve this answer

Server names may be useful, depending on what the name is. For example, if the server name is "db3", then its role is probably a database server, while if it's name is "dev1", then it's probably a development server. What does that tell you? It might tell you which one to attack first.

Alternately, if it contains a real domain name, then that might clue you in as to who owns the server, which might help focus your attack.

If the server's name is "galileo" or "sasquatch", that probably doesn't tell you anything at all.

share|improve this answer
    
I think the OP is referring to webserver, etc names - not hostname. –  George Bailey Dec 31 '12 at 14:54
1  
Note that db3 tells you that this is a third database server, therefore it is likely that db1 and db2 probably have existed at some point in time (and maybe they still do). –  Piskvor Dec 31 '12 at 14:59

Knowing the exact version of the web server (and application server and DBMS) helps you a lot when performing a test.

First and foremost, it helps you when checking for public exploits and vulnerabilities.
Let's look at a famous example: kingcope's killapache.pl. The script targets a specific vulnerability found in several versions of Apache HTTP Server, which was later fixed by the vendor.
If you knew the version of the web server on the target host, you could use the public exploit only if the version is known to be vulnerable and you wouldn't bother to test exploits made for, say, Microsoft IIS.

Furthermore, knowing the version of the web server allows you to make use of default resources (e.g. Apache's) and possibly exploit them.

The same principles apply to the application server and, even more, to the DBMS. Knowing the version of the database used by the target web application, for example, allows you to test using the correct SQL syntax right away.

share|improve this answer

It's considered one of the things to certainly test according to the owasp testing guide. If the server is advertising the version number, an attacker can reduce his scope of attacks significantly. Refer to https://www.owasp.org/index.php/Information_Leakage

share|improve this answer

Along with the Server header, there are other headers that can give valuable information, like X-Powered-By. This can help you to find out what framework/language was the site coded with. There are attack vectors only applicable to certain languages, so that gives you an idea of what attacks you can start with.

share|improve this answer

When thinking about a penetration test it is useful, but it depends upon the stage of the test. This would fall under the category of information gathering this phase is when you would be gathering information similar to this. This information can be used to compile a more complete look at an organizations infrastructure. If you discover an Apache server you now know which platform and hopefully version you will need to research for potential vulnerabilities.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.