Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 12 down vote favorite
3

I'm bulding a website but some webtools and browser plugins allows anyone to get information on which technologies the website has been built. Is there any Alternative to not reveal that we are working on server that process php ?

share|improve this question
Out of curiosity, can you link some of these webtools and browser plugins? – liori Feb 18 at 21:44
2  
@liori github.com/ElbertF/Wappalyzer – vedarthk Feb 19 at 6:41

2 Answers

up vote 19 down vote

Don't provide any information to anyone unless its absolutely necessary.

You should set expose_php=off in your PHP.ini. This tells PHP not to expose the "x-powered-by" HTTP header as well as the strange quarks that can be used to identify it. You should also set display_errors=Off which could be used to identify PHP as well as error-based vulnerabilities like SQL Injection. These two configurations should be used on all production systems. You can go a step further and remove or change the .php extension with mod_rewrite.

This is along the same lines as "banner information disclosure", which is revealing version information via service banners. You should be able to configure your HTTPD to suppress this information. In an Apache production environment set ServerTokens ProductOnly (thanks tftd). But this will just remove the version number, if you want to remove the word "apache" you have to use mod_security.

You could also lie >:). You can use mod_header to set any header, including a fake x-powered-by, and just adopt .aspx file extensions using mod_rewrite.

share|improve this answer
5  
In addition to what you said, some variables like PHPSESSID should also be renamed. Using a URL rewrite scheme would also make guessing harder. – Dinu S Feb 18 at 20:05
1  
In addition to both of you, if you're using apache, it's best practice to set ServerTokens ProductOnly – tftd Feb 18 at 20:23
The expose_php=off will also hide the Easter egg query strings (not sure if that's what you meant by quirks). – detly Feb 18 at 22:10
Note that these kind of settings probably won't affect persons that are able to e.g. fingerprint your server by analyzing the timing of responses. It might be pretty tricky to get around that kind of fingerprinting anyway. Maybe Rook can indicate if there is anything that can be done to make fingerprinting the server harder? – owlstead Feb 18 at 23:25
4  
And hiding the tools used to build the site will not help with the 99.9999% of attacks which blindly fire exploits. Targeted attacks are not that common, and this is just security by obscurity. – symcbean Feb 19 at 9:49
show 3 more comments
up vote 3 down vote

You can achieve a little more of security through obscurity by also tweaking the following values:

php_flag display_startup_errors off
php_flag display_errors off
php_flag html_errors off
php_value docref_root 0
php_value docref_ext 0

You can find some good advices here:

http://php.net/manual/en/security.hiding.php

share|improve this answer
Its not security though obscurity, its patching information disclosure vulnerabilities. – Rook Feb 19 at 18:57
@Rook I understand your point but I still consider this kind of tweak something which is related to security through obscurity. – LMGTFY Feb 19 at 20:13
Just to clarify the precedent thouht: I think that If something was bullet-proof, you wouldn't care to hide or spoof this type of informations. – LMGTFY Feb 19 at 20:26
1  
I agree but this kind of preventive approach will only makes things harder for an attacker: if you use a vulnerable PHP version, hiding error messages and version number doesn't protect you from someone who tries to exploit the known vulnerability by trial (from which the definition of security through obscurity). – LMGTFY Feb 19 at 20:48
1  
If anything, you might want to continue to advertise your versions, so a) you remain highly aware of keeping tight version control in your infrastructure and b) maybe some nice white hat will alert you if you are vuln to some 0day attack. :-) – deed02392 Feb 20 at 15:26
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.