0

My personal Apache server occasionally gets some pretty obvious scans for vulnerabilities. The client that does the scanning does GET HTTP/1.1 methods on a variety of URLs, and uses a variety of User-Agent fields. The scanner seems to always use the following HTTP headers in every request (not necessarily in this order):

Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
Connection: Close

I've tried some of the open source web client libraries (Perl's libwww-perl, PHP's curl library, Python, wget, pmapwn, maybe a few others) but by default, nothing I've tried generates HTTP requests with that combination of Accept, Accept-Language and Accept-Encoding header values.

Based on Nmap operating system identification shortly after scans, and p0f passive identification, the client or scanner most probably runs on Linux.

What HTTP client or vulnerability scanner generates GET requests with those header values? Can anyone point me to the source code for it?

EDIT

I'll give more info. The User-Agent field on this scanner sometimes shows up as "Morfeus Fucking Scanner", "Morfeus", "ZmEu", "Made by ZmEu @ WhiteHat Team - www.whitehat.ro", and possibly others. No, it's not the pmapwn scanner that has had "ZmEu" as its User-Agent sometimes.

Improve this question

1 Answer 1

Reset to default
2

Accurately fingerprinting a vulnerability scanner by inspecting the HTTP header fields can be inaccurate and inefficient. Pretty much any decent http client will allow you to change/modify/add HTTP headers, so you never know if the user running it has changed those headers.

For example, a common open source vulnerability scanner skipfish has flags to mimic a browser in its request patterns. From its documentation:

By default, skipfish sends minimalistic HTTP headers to reduce the amount of data exchanged over the wire; some sites examine User-Agent strings or header ordering to reject unsupported clients, however. In such a case, you can use -b ie or -b ffox to mimic one of the two popular browsers; and -b phone to mimic iPhone.

Improve this answer
2
  • Right, and I noted that above: User-Agent changes, but the Accept, Accept-Language and Accept-Encoding do not change. Besides, it's pretty clearly not a "decent vulnerability scanner" - it's some kind of half-baked script-kiddie cr@pcode.
    – Bruce Ediger
    Commented Jul 6, 2012 at 17:24
  • 2
    Well again, someone might have configured it to try different user-agents while keeping the other headers constant. One could just be using wget in loop, who knows !! $ wget --header='Accept: */*' --header='Accept-Language: en-us' --header='Accept-Encoding: gzip, deflate' --header='Connection: Close' http://localhost If you are looking for an scanner that in its default setting sends these headers, there could be more than one - given these are such a general header values.
    – CodeExpress
    Commented Jul 6, 2012 at 19:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .