0

I need need to hide server details using apache server whenever there is 404 or 403 error.

I tried with the below two changes in httpd.conf file.

    ServerSignature Off 
    ServerTokens Prod 

However , still Im seeing the server details whenever there is a 404 or 403 error.Do I need to have any module installed for this to work.

Note: Im using Windows 7.

closed as off-topic by Stephane, Ohnana, Dog eat cat world, Steve Dodier-Lazaro, Eric G Jan 28 '16 at 15:59

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    This is called web server fingerprinting, OWASP has a section about this owasp.org/index.php/Fingerprint_Web_Server_(OTG-INFO-002) Basically, how the server responds to different requests and the headers and the order in which they are sent help identify a web server. – Purefan Jan 28 '16 at 8:51
  • 1
    Sure Purefan, I will have a look into it, thanks :) – balaji Jan 28 '16 at 11:49
4

Try creating some custom error response pages. A plain old HTML page that just says something along the following lines:

ERROR 403: You are not authorised to access this resource.

It doesn't even need any formatting.

  • hey Philip, thanks for ur reply, now from my side I have added only ErrorDocument 403 “not found” at the end of httpd.conf file, and restarted my server. Still Im seeing the old message only with the server details, do I need to anything else? – balaji Jan 28 '16 at 9:04
  • @balaji Check that it isn't configured elsewhere in the httpd.conf file - that might be overriding it. – Philip Rowlands Jan 28 '16 at 9:34
2

Can't tell if that's a typo or not. But you wrote ErrorDocument 403 'not found'. Remember that each of the various error messages corresponds to a different condition. So, for example, Error 403 is not the error that happens when someone looks for a URL that doesn't exist. Error 404 is what is transmitted in that case. If you really want to override ALL of the error messages, then you need a complete and comprehensive list. According to Google, the most common HTTP errors that people encounter (and thus the most important for anonymising—assuming anonymising is worth doing) are these:

  • 500 Internal Server Error
  • 404 Not Found
  • 403 Forbidden
  • 401 Unauthorised
  • 400 Bad Request

You'll need at least 5 distinct lines in your httpd.conf file, one for each of these. Something like:

ErrorDocument 500 Error
ErrorDocument 404 Error
ErrorDocument 403 Error
ErrorDocument 401 Error
ErrorDocument 400 Error

You will struggle to test some of these. Error 404 is trivial to test. The others require a bit of configuring before you could set up a test case.

  • It is actually possible to just use a string: ErrorDocument "403 HAAAAX! THE HAAAAAAAAAAX" will create a plain empty HTML page with those words, and both single or double quotes are acceptable. So, it's not actually a typo – Philip Rowlands Jan 28 '16 at 10:56
  • 1
    The possible typo was 403 not found versus 404 not found. The OP would have a harder time testing 403 versus 404. And it's entirely possible his test failed because he thought his error 403 should have been coming up, but it wasn't because he was triggering 404s. – Paco Hope Jan 29 '16 at 13:07
  • Ah, I thought you meant single quotes vs double quotes. – Philip Rowlands Jan 29 '16 at 13:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.