Change Apache and Fingerprint.

hack3rcon · 05-22-2016, 05:06 AM

Hello.
I want to install Apache on CentOS but I want change the version of it and hide it from scanners. For example, Nmap detect my Apache as Nginx. Can you show me the correct file in source code of Apache for do it?

Tnx.

Turbocapitalist · 05-22-2016, 07:05 AM

It would probably be the part that sets ServerTokens

But changing that won't hide it from scanners. What are you trying to solve?

hack3rcon · 05-23-2016, 01:24 AM

How can I change my Apache to Nginx when scanner scan it?

astrogeek · 05-23-2016, 01:58 AM

You can only mask the apache version by setting...

Code:

ServerTokens Prod

... Which will make it report only as "Apache".

To change it to something else like Nginix you have two main choices as far as I know...

1. Modify the source code and recompile (not actually difficult).
2. Use ModSecurity which has the ability to replace the ident string, within some strict length constraints.

Use of ModSecurity is very advisable anyway, for an internet facing server, but you will need to learn how to configure it - it is not plug-n-play.

Turbocapitalist · 05-23-2016, 01:58 AM

Install the SRPM for the package and then modify the included source, using the above clue as to where to look. Then rebuild an RPM from the spec file.

Edit: Or astrogeek's suggestion of mod_security would be easier. SecServerSignature is probably the setting you want.

Turbocapitalist · 05-23-2016, 02:27 AM

If mod_security is not enough, then you might need to modify more headers. That can be done with mod_headers

hack3rcon · 05-23-2016, 02:36 AM

Quote:

Originally Posted by astrogeek

You can only mask the apache version by setting...

Code:

ServerTokens Prod

... Which will make it report only as "Apache".

To change it to something else like Nginix you have two main choices as far as I know...

1. Modify the source code and recompile (not actually difficult).
2. Use ModSecurity which has the ability to replace the ident string, within some strict length constraints.

Use of ModSecurity is very advisable anyway, for an internet facing server, but you will need to learn how to configure it - it is not plug-n-play.

Which file in source code must be changed?

astrogeek · 05-23-2016, 02:46 AM

The one which defines the identity string?

I do not know what the exact filename is, but should not be difficult to find.

But from my own experience, ModSecurity is a better option if you are looking for better security anyway.