The Stack Overflow podcast is back! Listen to an interview with our new CEO.
51

Yes, in theory by advertising vendor and version in the banner makes an attacker's job easier, but like only a little bit. Even if you don't advertise it, it can be figured out from the behaviour of the app. Take for example, the network scanning tool nmap: Nmap provides a number of features for probing computer networks, including host discovery and ...


28

Attackers just do not care. When you have a popular website, you find bots probing for every (vulnerable) version of phpmyadmin on every conceivable path, even when your site does not use a database at all. In the same manner, they probably probe for security holes in every version of, e.g., apache. Lying on or omitting the Server header does not buy you ...


13

Historically, many servers returned headers like this: Server: Apache/2.4.1 (Unix) mod_php/1.2 mod_ssl/0.9 This does give away a bit more information than you want, so most servers now default to headers like this: Server: Apache In fact, most web servers make it difficult to turn off this header. The reason? Marketing. They want to appear in surveys ...


7

This site describes the techniques used in canvas fingerprinting: The technique is based on the fact that the same canvas image may be rendered differently in different computers. This happens for several reasons. At the image format level – web browsers uses different image processing engines, image export options, compression level, the final images may ...


5

As said, it's not a security issue to leave it, and it's a useful information for some client programs. Take curl for instance: it uses the Server header value to check if HTTP pipelining can be enabled: Taken from https://serverfault.com/a/596560/347610 [curl shows this message when run in verbose mode -v]: * Server Apache/... is not blacklisted ...


3

For an AV that looks for a signature, splitting your malware across files means the signature no longer exists. The AV doesn't concatenate multiple files in order to speculatively match for signatures. This is obfuscation, of a simple kind. So if you want to scan the file for a signature, do not split it, as this prevents you seeing the signature.


2

TL;DR: No extra setup required. Concept: Try to understand what Tor does. Tor builds a Proxy Chain for you to access the Internet. Your single request is routed through several different Tor nodes (known as relays) before reaching the host. The host only sees the IP address of the last node in your Proxy chain as the requesting IP address and returns the ...


2

You could use use the -T4 option together with the -A. No sudo is required (Tested on Ubuntu). $ nmap -T4 -A 192.168.0.0/24 Would return for instance: Nmap scan report for 192.168.0.95 Host is up (0.00060s latency). Not shown: 996 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1 (protocol 2.0) | ssh-hostkey: ...


2

Don't bother with that "spliting". I would like to know how the malware fingerprints work in common AntiVirus My suggestion to you is to read how ClamAV works, you can start here. Learn about creating signatures: https://www.clamav.net/documents/creating-signatures-for-clamav And yeah, don't forget to try YARA.


1

Because hiding version information is a weak security measure and a form of security through obscurity. The amount of security it adds is debatable, given that a) attackers can still fingerprint and probably determine your server, version and mods within a narrow margin of error and b) attackers can simply throw their whole library of exploits at you anyway. ...


1

This depends what you mean with "alongside". If you start your VPN all your traffic will be going over VPN, which means your setup is essentially VPN->Tor when using the Tor browser. Everything you do outside the Tor browser will of course only go over VPN. So as to your question: yes you can open VPN and then use the Tor browser. This also hides the fact ...


1

There are several hints, but the most obvious ones would be: On the current Windows versions the existence of C:\Program Files (x86)\ tells it's a 64-bit system. Any 32-bit version doesn't have it. You could download C:\Windows\System32\ntoskrnl.exe. On it's version X.Y.Z the X.Y reveals the Windows (NT) version and Z the build. (5.0 for 2000, 5.1 for XP, 5....


1

Assuming you are referring to this project which exposes a fingerprinting library under that name, the only effective way to avoid fingerprinting without blocking the script is to use a browser that has a common fingerprint. Unfortunately, browsers have so many fingerprints that the only reliable way to do this would be to use the Tor Browser, which enforces ...


1

Panopticlick is not a comprehensive browser fingerprinting analysis tool. In fact, it is pretty poor and only exists to raise awareness about fingerprinting. For example, it doesn't do the extensive WebGL fingerprinting was touched by recent research papers. Because of that, it does't take into account the fact that WebGL can be used to identify an ...


1

Most spammers aren't actually humans, but automated scripts sending forged requests to your site. Identifying them though JS is pointless, because they won't run it. Identifying them based on server headers might work for a while, but they will likely look just like a normal user's, and the spammer might well change them if you start blocking their requests. ...


Only top voted, non community-wiki answers of a minimum length are eligible