Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a web server, and I would like to anonymise it as much as possible, to prevent unreported exploits directed at my web server (original cracks).

My ideas:

  • change server header
  • customize 404 pages

My homepage headers:

HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Last-Modified: Mon, 26 Aug 2013 14:33:29 GMT
ETag: "3159055821"
Content-Type: text/html
Expires: Tue, 27 Aug 2013 22:42:28 GMT
Cache-Control: max-age=21600
Content-Length: 939
Date: Tue, 27 Aug 2013 16:42:28 GMT
Server: unspecified

Open Ports (nmap):

  • http
  • ssh

There is no dynamic content being generated (e.g. no PHP or anything).

Question: Are there any additional steps required to subvert server/version detection?

share|improve this question
up vote 3 down vote accepted

The operating system itself will be recognized by attackers, by analysing subtle details of TCP/IP packets. Nmap can do that easily. The SSH server also has a banner (sent as first element upon connection) which can give a lot of clues. Similarly, the software you use will probably be revealed by its dynamics. What you think of as a single, atomic "HTTP header" will be sent as one or several elementary write() calls, which will then be emitted as some IP packets; the position of the split, and the exact timing between the emissions, may tell quite a lot on the involved software.

The ordering of HTTP headers may also give clues about the server software. I see that you use gzip compression: zlib will be involved, but not all versions compress the same input to the exact same sequence of bytes (decompression is fully deterministic, but compression leaves open a lot of choices, and each version of zlib can make distinct choices when it strives to achieve the maximum compression rate or the fastest operation).

The only surefire way to hide your software version is to write your own software (and never publish it). Writing your own operating system or at least TCP/IP stack, though feasible, is a quite daunting endeavour.

Anyway, I will argue that preventing version detection is not really relevant. If an attacker knows one or two unpublished attacks, then... he will just try them out. Just in case. He does not need to know the exact version of the software for that. Knowing the exact version is useful only when the attacker has hundreds or thousands of exploits to choose from, and does not have enough time to try them all; this situation does not apply to unreported exploits, which tend to be valuable because they are rare. A given attacker would consider himself very lucky indeed if he has access to more than two or three exploits which are, as yet, unknown to the public at large.

share|improve this answer
Thank you. I had no idea about the SSH and zlib information. My goal isn't to aggressively prevent information from being gathered, but to try to reduce it in hope that my firewall will prevent the attack before vector X is attempted, where X would compromise my server. Is this a good way to go about it, or do you recommend something else? – FakeRainBrigand Aug 27 '13 at 17:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.