Fingerprint Web Server

Check List

• Determine the version and type of running web server to enable further discovery of any known vulnerabilities.

Methodology

Banner Grabbing

1

Connect to the target website’s HTTP service to retrieve server banners, identifying software and version details for potential vulnerability mapping

2

Manually interact with the HTTP service to capture raw server responses, extracting information about server software, custom headers, or configurations

3

Fetch HTTP headers from the target to analyze server details, powered-by information, or security headers, uncovering potential misconfigurations or outdated software

4

Perform stealth scanning and service enumeration on the target, using scripts to extract page titles, headers, supported HTTP methods, and favicon details, building a comprehensive profile of the web server

5

Use an online service to query the target’s technology stack, gathering details about CMS, frameworks, hosting providers, or server software for reconnaissance

6

Leverage a DNS reconnaissance tool to enumerate subdomains, DNS records, and associated IP addresses, mapping the target’s infrastructure and potential entry points

7

Search for web servers by their server header to identify instances running specific software, narrowing down targets for version-specific exploit research

8

Query SSL certificate fingerprints (SHA-1 or SHA-256) to locate hosts with matching certificates, revealing related domains or misconfigured SSL setups

9

Identify hosts by SSL certificate common name (CN) to uncover subdomains or assets tied to the target, expanding the attack surface for testing

10

Detect operating systems via response headers to identify server OS types, prioritizing outdated or vulnerable systems for exploit targeting

11

Search for powered-by headers to identify backend technologies like PHP or ASP.NET, assessing version-specific vulnerabilities or misconfigurations

---

Using Automated Scanning Tools

1

Run a WAF detection tool to identify the presence and type of web application firewall, analyzing bypass opportunities or WAF-specific weaknesses

2

Use an automated WAF identification tool to confirm firewall presence and fingerprint its technology, aiding in crafting payloads to evade protections

3

Execute a web fingerprinting tool to detect CMS, frameworks, and server technologies, building a detailed profile of the target’s stack for vulnerability prioritization

4

Deploy an automated reconnaissance suite to perform comprehensive scanning, combining subdomain enumeration, port scanning, and vulnerability checks for a holistic assessment

5

Conduct a web vulnerability scan to identify common issues like XSS, SQLi, or misconfigurations, prioritizing findings based on severity and exploitability

6

Fingerprint GraphQL endpoints on the target to detect exposed APIs, analyzing schema details or misconfigurations for potential data exposure or injection attacks

---

Cheat Sheet

Banner Grabbing

Netcat

nc -v $WEBSITE 80

Telnet

telnet $WEBSITE 80

Curl

curl -I $WEBSITE

Nmap

nmap -sS -sV -Pn --mtu 5000 \
     --script http-title,http-headers,http-server-header,http-security-headers,http-methods,http-put,http-robots.txt,http-favicon \
     $WEBSITE

NetCraft

What's that site running?What's that site running? | Netcraft

Dnsdumpster

DNSDumpster - Find & lookup dns records for recon & researchDNSDumpster.com

Censys

Server Header

services.http.response.headers.server: "nginx"

SSL Certificate SHA-1 Fingerprint

services.tls.certificates.leaf_data.fingerprint_sha1: $HASH

SSL Certificate SHA-256 Fingerprint

services.tls.certificates.leaf_data.fingerprint_sha256: $HASH

Common Name (CN) in SSL Certificate

services.tls.certificates.leaf_data.subject.common_name: "$WEBSITE"

Operating System

services.http.response.headers: (key: "OS" and value.headers: "Linux")

Powered By Header

services.http.response.headers.x_powered_by: "PHP/7.4.9"

Using Automated Scanning Tools

WAFW00F

wafw00f $WEBSITE

WhatWaf

whatwaf -u $WEBSITE

WhatWeb

whatweb $WEBSITE

Sn1per

sniper -t $WEBSITE

Arachni

arachni $WEBSITE

Graphw00f

graphw00f -f -t $WEBSITE