55 votes
Accepted

Why do some web servers still provide information on vendor and version in the HTTP response headers

Yes, in theory by advertising vendor and version in the banner makes an attacker's job easier, but like only a little bit. Even if you don't advertise it, it can be figured out from the behaviour of ...
Mike Ounsworth's user avatar
28 votes

Why do some web servers still provide information on vendor and version in the HTTP response headers

Attackers just do not care. When you have a popular website, you find bots probing for every (vulnerable) version of phpmyadmin on every conceivable path, even when your site does not use a database ...
allo's user avatar
  • 3,372
15 votes

How can I detect the remote operating system?

Using nmap: sudo nmap -O <target> Or if they block your ping probes you can do: sudo nmap -O <target> -Pn Sometimes you still get fake results and you should try doing an aggressive ...
Lucian Nitescu's user avatar
14 votes

How do exploit kits enumerate or fingerprint their targets?

I think you might be assuming that the kits are more complicated than they are. A kit is designed to exploit specific vulnerabilities. It is not necessary to 'fingerprint' and choose the best ...
schroeder's user avatar
  • 129k
14 votes

Why do some web servers still provide information on vendor and version in the HTTP response headers

Historically, many servers returned headers like this: Server: Apache/2.4.1 (Unix) mod_php/1.2 mod_ssl/0.9 This does give away a bit more information than you want, so most servers now default to ...
paj28's user avatar
  • 33.4k
11 votes
Accepted

How well Tor protects against fingerprinting?

When you do not change anything, the Tor browser is already configured in a way that the fingerprint is identical to every other Tor browser (and is close to the most common fingerprint on the web). I ...
Noir's user avatar
  • 2,573
10 votes
Accepted

Effect of Firefox's "Responsive Design Mode" on the browser's fingerprint

There is no single fingerprinting method. But assuming that the fingerprinting you fear tries to be as granular as possible it will not only include easily fakeable things like User-Agent header but ...
Steffen Ullrich's user avatar
7 votes
Accepted

How does a keypair fingerprint work?

Pubkey is INCLUDED in privkey It's a bit confusing but the way these members of the keypair are saved is such that the pubkey is a proper subset of the information inside the privkey. This means that ...
StackzOfZtuff's user avatar
7 votes
Accepted

Will two smartphones (identical hardware and software) generate the same canvas fingerprint?

This site describes the techniques used in canvas fingerprinting: The technique is based on the fact that the same canvas image may be rendered differently in different computers. This happens for ...
Mike Ounsworth's user avatar
6 votes

Can canvas hash be used to track me and ruin my anonymity?

Canvas Fingerprinting The technique you are referring to is Canvas Fingerprinting. It is one of many possible methods available for website operators to try to identify and track users without ...
Conor Mancone's user avatar
6 votes
Accepted

Application to detect SSL certificate fingerprint differences

There is a mechanism called Certificate Transparency. It is based on a system of public logs of issued certificates. Here you can red how it works. MITM can have different reasons. For instance, some ...
mentallurg's user avatar
  • 12.4k
5 votes
Accepted

What is vulnerable in this comprehensive browser setup to avoid fingerprinting/tracking?

Given that you're attempting to defend against a Google "all-seeing-eye" attack, (and not the NSA), this is a good start. I've added a couple suggestions below. Your search engine activity will be ...
John Deters's user avatar
  • 34.2k
5 votes

How are Google always identifying me?

Misuse of free accounts for spamming and similar is a big problem many providers face. Thus they try to detect early if an account creation is somehow unusual, like being automated by a computer or ...
Steffen Ullrich's user avatar
5 votes
Accepted

methods to check https certificates

Try this echo -n | openssl s_client -connect www.security.us.hsbc.com:443 2>/dev/null | openssl x509 -noout -fingerprint -sha256 The output should look like this: $ echo -n | openssl s_client -...
MikeSchem's user avatar
  • 2,361
5 votes

Why do some web servers still provide information on vendor and version in the HTTP response headers

As said, it's not a security issue to leave it, and it's a useful information for some client programs. Take curl for instance: it uses the Server header value to check if HTTP pipelining can be ...
Xenos's user avatar
  • 1,371
5 votes
Accepted

What impact does an installed extension have on the browser fingerprint (uniqueness)?

There are no explicit APIs to enumerate the browser extensions. But this does not mean they are not detectable or that they cannot be included in the fingerprint even if the specific extension is not ...
Steffen Ullrich's user avatar
5 votes

Is there any secure way to make sure that a request comes from a browser and via a specific domain (by just using frontend)?

We could use referer or origin, but these HTTP headers can be easily overwritten or modified. A browser can not overwrite or modify these headers. At most it can make the referer blank or reduce to ...
Steffen Ullrich's user avatar
4 votes

Unique(ish) OS / hardware fingerprinting

The Electronic Frontier Foundation (EFF)'s Cover Your Tracks (previously called Panopticlick) site is dedicated to browser fingerprinting that goes well beyond your desired 1:1000 entropy (using these ...
Adam Katz's user avatar
  • 11.2k
4 votes
Accepted

Can HPKP be used to track users?

HPKP could be used for tracking in big scale since it has report URIs: Send HPKP header with includeSubdomains set and a report-uri with unique random generated parameter. Embed a hidden image from a ...
you's user avatar
  • 56
4 votes

How can I detect the remote operating system?

You could use use the -T4 option together with the -A. No sudo is required (Tested on Ubuntu). $ nmap -T4 -A 192.168.0.0/24 Would return for instance: Nmap scan report for 192.168.0.95 Host is ...
user9869932's user avatar
4 votes

Fingerprinting users based on IP addresses

IP addresses were never designed as a secure means of identifying anyone, and you should be wary of trusting them to perform a security function. There are several reasons not to, but the main one is ...
John Deters's user avatar
  • 34.2k
4 votes
Accepted

Fingerprinting users based on IP addresses

It could, and it does, but not as much as you'd think. Your IP address can be unique or it can be different on a per-user bases. If you live alone and have your own cable model, then - for a while - ...
iAdjunct's user avatar
  • 1,700
4 votes

How well Tor protects against fingerprinting?

The fingerprinting that could be used to identify a browser depends on what features are available. If you're running a bare-bones browser with everything disabled there is very little data to ...
just some user's user avatar
4 votes

Why do browsers expose installed fonts?

Browsers don't directly make a listing of the installed fonts available. Instead they provide information about the size a specific object like a textbox has. Since the same text rendered with ...
Steffen Ullrich's user avatar
4 votes
Accepted

Why do browsers expose installed fonts?

For ultra-precise screen layouts like games, a developer often needs to know the size something renders at. While a dev can instruct the browser to draw at say, 10px, OS font size settings, zoom, font ...
dandavis's user avatar
  • 2,693
4 votes
Accepted

Why fingerprint a browser if a fingerprint can be replayed?

Passive fingerprinting can easily be faked, and it is trivial to code responses that can pass passive fingerprinting. And yet, it can still work because not every bot includes this feature because not ...
schroeder's user avatar
  • 129k
3 votes

OS fingerprinting via TCP

OS detection goes a lot further, using all kind of data of the IP and TCP headers fields. If you're into reading, "Silence on the Wire" by Michal Zalewski addresses a lot on this topic.
AJK's user avatar
  • 31
3 votes

Why does Tor Browser disable Javascript optimizations?

The presence of certain JavaScript features can be used to fingerprint the person like "X's unique hash is ...". Whereas the absence of certain JavaScript features can be used to fingerprint the ...
Samuel Shifterovich's user avatar
3 votes

Fingerprinting servers behind firewall

There are a lot of possibilities for that: 1- No ports are really open other than 80. 2- Firewall is not blocking your IP but it might be evade your results and this only with advanced firewall. 3- ...
Opaida's user avatar
  • 323
3 votes
Accepted

Fingerprinting servers behind firewall

When I try to pentest I like to use hping3, which you can install it very easily: apt-get install hping3 Then for bypassing firewall: hping3 -S 192.168.1.1 -c 80 -p ++1 If port 25, 53 or 80 is ...
Mirsad's user avatar
  • 10.2k

Only top scored, non community-wiki answers of a minimum length are eligible