1

Short version

How can I determine the Java version a remote server is running if I only have access to the server through port 443?

Long version

I am validating a pentest run by another group. They found an error message that provided the Java version being run by the remote server. The Java version was an old one. The developers have apparently made changes that prevent the error message from appearing, thus hiding the Java version.

My job is find out if the developers also updated the java version. How can I do that without access to the server other than through HTTPS via port 443?

Improve this question
2
  • Are you looking for the actual version of JSE/JEE, or a servlet container like Apache Tomcat? I'm assuming the former but just wondering. Also, if the application server (at port 443) is related to Java in some way then that might be useful information.
    – itscooper
    Commented Jan 16, 2014 at 17:19
  • I am looking for the JEE version.
    – user2616211
    Commented Jan 28, 2014 at 19:09

2 Answers 2

Reset to default
3

Are you validating the results or the server? You seem to be confusing the two.

Preventing info disclosure through error messages is a good thing. You verified that is fixed. It doesn't seem to be your job to validate that the Java version is updated (since it appears to be a black-box test), for that, you leave that to the server operator to report on. Make a note that it's no longer obvious what the version is, and encourage the report audience to validate the server to confirm.

Improve this answer
0

Well Ideally a secure server would do a pretty good job hiding this information. There is no hard set way. Two good ways are by examining the server response headers and looking for error pages. There are a lot of tools online made for things like this.

I would recommend starting by looking at server response headers, and if that doesn't reveal anything try to create errors by supplying invalid input and requesting pages that you know are broken or don't exist.

Improve this answer
1
  • Both -- after I found the app no longer displayed info about the Java version, the compliance people asked if I could determine the Java version. The application developers have a habit of not fully complying. I have a habit of digging until someone grabs my tail and pulls me away.
    – user2616211
    Commented Jan 22, 2014 at 16:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .