Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
My questions refer detecting fake User-Agent, in sense of spoofing user OS, web-browser and other info sent in headers from users browsing resources on my server.
Is there a way to detect if user is using some tools to fake his fingerprint, e.g. by setting a fake User-Agent? Is it possible to detect if a user changes it's headers by browser developer tools or some other more sophisticated anonymization software?
User Agent is always sent to you by the client, and you have no control over what the client sends to you. However, the bot/crawler/scraper (whatever the script is) that queries your website content, may be written such that they only spoof User-Agent for your website. Let them load a picture from an external domain which you control, and you might gather their real User Agent information there. This all depends on how the script that accesses your website is written, in some cases it will work.
This may not be possible directly from Apache however analysis of the network HTTP packets themselves may reveal details such as TTL and TCP Window Sizes that would indicate that they don't match up with the platform/browser. I am sure some Intrusion Protection Systems (IPS) offer this capability out of the box.
