I know I can use tools such as BuiltWith and Wappalyzer to find a web app's web server, but is there a way of determining the specific web server's version?

The web app I am looking at has a nginx web server, and I am trying to determine the specific version of the web server to find explicit vulnerabilities and exploits.


There is no general way to reliably determine the exact server version from remote and it is not even possible to reliably get the more general type of server (i.e. apache, nginx, IIS ...).

While the server might include its version in the Server field of the response header or in error messages, this might be only the type of server and not the exact version. And even if there seem to be detailed information available they might not be true - it is not that unusual to provide fake information there is order to lead potential attackers to a false track.

  • 1
    And even without intent to mislead, some (many?) Linux distros have a policy of 'freezing' the versions that are tested and then included in a release, then backporting only security patches rather than taking a new upstream version which could create incompatibilities with other packages. This is more important with libraries like OpenSSL, but TTBOMK the policy applies to apps also. – dave_thompson_085 Jun 20 '19 at 9:05

Sure. Have a look Testing for Web Application Fingerprint

  • For the exact version this is just looking at the information explicitly and voluntarily provided by the server, which might be true, might be deliberately wrong to irritate attackers or might be simply missing. Other indicators listed there like order of headers are usually not specific for a single server version. – Steffen Ullrich Jun 19 '19 at 20:35
  • @SteffenUllrich Yes, you're absolutely right but the OP is asking if there is a way, not whether it is reliable but as you have already stated the information returned might be true, might be completely wrong or not present at all but on the other hand we could also assume that the web app is behind a proxy :-) – blabla_trace Jun 19 '19 at 20:50
  • "... OP is asking if there is a way, not whether it is reliable ..." - the expectation of the OP clearly was to get the version of a specific software and not some value which might or might be not the version of the software. Thus, your answer should have at least pointed out that these are self-reported values which might be incomplete or wrong. – Steffen Ullrich Jun 19 '19 at 20:55
  • We can not say with certainty what data the web server would return. If there's a better way to determine the true version rather then some random data, please feel free to share. – blabla_trace Jun 19 '19 at 21:05
  • @SteffenUllrich Yup, the answer didn't help me find the specific web server version, but I can't seem to find a definitive answer.. – Nick Jun 19 '19 at 21:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.