I would like to know that how vulnerability scanners identify the version of services running on the target after identifying the service by the port number.

  • Do you mean banner grabbing? – jarryd Jan 27 '18 at 20:58

How Fingerprinting works

For every service fingerprinting would be done differently, generally, it works by finding differences between the implementations, and using them to detect the version of the software, I have included a few simple examples:


If you run the following command:

nc HOST 22

You can see that the first thing that a server sends is a string identifying it's version, such as:

SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.4

From this you can get the version


If you run the following command:

curl -v URL > /dev/null

You can see that the server sends many headers, one of which is likely to look like this:

< Server: cloudflare

This can show you the server if it has not been changed, and possibly the plugins running also


Looking at the feed available at /feed/ gives an xml file with the following tag:


If this is disabled then differences in the readme can be used to detect the version instead

  • short answer is: the service tells you what version it is – schroeder Jan 27 '18 at 17:43
  • @jrtapsell Thank you so much for the detailed answer. – hanzalah Feb 1 '18 at 15:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.