I am currently working on penetration test of a web site that uses an Apache HTTP server. To test a vulnerability which is related to mod_cgi module, I need to know whether this web site uses mod_cgi module of Apache or not? How can I determine this?
The first place to look is the server header. Depending on the server configuration it may report all enabled modules. Alternately you can use a specially formulated request which will provide a less reliable detection. The AddHandler directive allows a script to answer with a non 501 response to incorrect HTTP verbs. I'm using this technique in my Apache profiling script (aprof) from my lbmap project: https://github.com/wireghoul/lbmap