Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Short version

How can I determine the Java version a remote server is running if I only have access to the server through port 443?

Long version

I am validating a pentest run by another group. They found an error message that provided the Java version being run by the remote server. The Java version was an old one. The developers have apparently made changes that prevent the error message from appearing, thus hiding the Java version.

My job is find out if the developers also updated the java version. How can I do that without access to the server other than through HTTPS via port 443?

share|improve this question
    
Are you looking for the actual version of JSE/JEE, or a servlet container like Apache Tomcat? I'm assuming the former but just wondering. Also, if the application server (at port 443) is related to Java in some way then that might be useful information. –  itscooper Jan 16 at 17:19
    
I am looking for the JEE version. –  user2616211 Jan 28 at 19:09

2 Answers 2

Are you validating the results or the server? You seem to be confusing the two.

Preventing info disclosure through error messages is a good thing. You verified that is fixed. It doesn't seem to be your job to validate that the Java version is updated (since it appears to be a black-box test), for that, you leave that to the server operator to report on. Make a note that it's no longer obvious what the version is, and encourage the report audience to validate the server to confirm.

share|improve this answer

Well Ideally a secure server would do a pretty good job hiding this information. There is no hard set way. Two good ways are by examining the server response headers and looking for error pages. There are a lot of tools online made for things like this.

I would recommend starting by looking at server response headers, and if that doesn't reveal anything try to create errors by supplying invalid input and requesting pages that you know are broken or don't exist.

share|improve this answer
    
Both -- after I found the app no longer displayed info about the Java version, the compliance people asked if I could determine the Java version. The application developers have a habit of not fully complying. I have a habit of digging until someone grabs my tail and pulls me away. –  user2616211 Jan 22 at 16:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.