1

Recently, during a pen-testing exercise, I noticed that the target server responded with multiple "Server" fields in the header. I was wondering what it could mean and if oddity is somehow interesting from a pen-tester's perspective.

And secondly, what is a "Syginet" server. I tried to google it but nothing came up.

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 17 May 2021 20:38:15 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Vary: Accept-Encoding
Server: SygiNet 1.3
Content-Length: 22447
2

The Server: HTTP header is defined in the HTTP spec RFC 7231 section 7.4.2. I see nothing in there saying that you can't have multiple of these, so I assume this is spec-compliant; ie valid HTTP.

I agree with you that I'm not finding anything on Google for "SygiNet". I'm guessing it's some sort of proxy sitting in front of the web server, and it's adding its signature to the response. Whether that's useful to your pentest to know that there are some extra proxies in there, I have no idea ...

1
  • I was confused by double Server field because the request would only be served by one. It was naive of me to not think of a proxy/LB sitting in front of the main server and adding its own signature.
    – 7_R3X
    May 20 '21 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.