Tryed to hack your own server lately?

Kanon · 01-15-2005, 11:48 AM

I did a small check of my server, and didnt like what I found!

The one thing that REALLY stands out is the version number. But I'd like to see the hole line go. So here are my Q's

1 How can I hide the server info!
2 Besides the browser side effects (I assume). Are there more to think of?

HTTP/1.1 400 Bad Request
Date: Sat, 15 Jan 2005 17:11:16 GMT
Server: Apache/1.3.26 (Unix) Debian GNU/Linux PHP/4.1.2
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>400 Bad Request</TITLE>
</HEAD><BODY>
<H1>Bad Request</H1>
Your browser sent a request that this server could not understand.<P>
The request line contained invalid characters following the protocol string.<P>
<P>
<HR>
<ADDRESS>Apache/1.3.26 Server at example.com Port 80</ADDRESS>
</BODY></HTML>

Tnx for any help, guys!

druuna · 01-15-2005, 12:16 PM

Hi,

In your httpd.conf file:

#--------------------------------------------------------------------#
# ServerTokens This directive configures what you return as the
# Server HTTP response Header. The default is 'Full' which sends
# information about the OS-Type and compiled in modules. Set to one
# of: Full | OS | Minor | Minimal | Major | Prod where Full conveys
# the most information, and Prod the least.

#ServerTokens Full
ServerTokens Prod

Hope this helps.

Kanon · 01-15-2005, 12:58 PM

Arg... I dont have that in my file.

I'll cut n paste.

Thanks a million! On to the server hack test...

Found this that explains my Q in the first place:

ServerTokens and hack attempt

Kanon · 01-15-2005, 01:03 PM

That worked like a charm! :-)

Kanon · 01-16-2005, 02:00 PM

Quote:

Originally posted by Kanon
<ADDRESS>Apache/1.3.26 Server at example.com Port 80</ADDRESS>

Eh.. How about the last line here? I didnt check to see if ServerToken tok care of that too.

lowpro2k3 · 01-17-2005, 04:41 AM

I was just thinking about that today actually... I read an article a while ago (or maybe a post) saying you can change the string at compile time in one of the header files (*.h) in the src/ directory. I cant remember which one, you could try grepping for it. I think it would be funny to change the name to a different Apache version to throw off would-be hackers quite a bit.

Kanon · 01-17-2005, 10:06 AM

My thoughts exactly. Or maybe have it report IIS! lol

Now, the only problem is; what is compiling? lol
I guess I have to postpone this untill I got me some more knowledge. And it looks like compiling is heading up on my list.

Thanks anyhow

SciYro · 01-17-2005, 09:08 PM

its not that hard, theres plenty of sites that give you step by step instructions on the compile process, and usually how to do it for each individual projects

Kanon · 01-18-2005, 04:13 AM

Looking at it right now. Found the code. But Im no programer.

Are there anybody, please!, that would like to have a look at the core.c
Search for Apache/2 (Yes, Apache ver 2.52)

What is needed to change the servertoken to report, say "IIS" or "Donald Trump" for that mater.

dominant · 01-18-2005, 04:33 AM

This is similar to

ServerSignature Off

or not?

Kanon · 01-18-2005, 04:45 AM

Well, if you look at the first post you see that Apache gives it self away both at the top and the bottom. The top one is ok. But the bottom one will not change with the ServerToken.

BTW Just tested "Off" didnt work on 1.3.

Ah...crap. Didnt read your post fully. I'll check the ServerSignature

Kanon · 01-18-2005, 04:50 AM

YES!!! Thas it!

So solution if you want to "hide" your Apache server for hacker wannabe change:

ServerToken = Prod
ServerSignature = Off

Thanks for the help druuna and dominant! :-)