Hiding Http tomcat server information.

gaurav_s · 05-27-2015, 02:22 AM

I need to test whether my tomcat server running on Redhat is hiding server info.
I have added server="testserver" in server.xml file.

But, i don't know how to test it on linux system (wget) as well as wireshark.
I want to see testserver instead of server version number.

bathory · 05-27-2015, 05:11 AM

You can use telnet on port 8080 (assuming tomcat listens on that port):

Code:

telnet localhost 8080

then write:

Code:

GET / HTTP/1.0

and watch the first few lines of the response

Or with nmap, like:

Code:

nmap -sV localhost -p 8080

If you want to suppress the version info from the error page, read this

Regards

gaurav_s · 05-27-2015, 06:14 AM

nmap and telnet both commands are not available in node i am working and i don't have installation rights .Please suggest any other command or Wireshark filtering mechanism.

bathory · 05-27-2015, 12:02 PM

Quote:

Originally Posted by gaurav_s

nmap and telnet both commands are not available in node i am working and i don't have installation rights .Please suggest any other command or Wireshark filtering mechanism.

I don't know how wireshark works, but I guess you can use it to capture http traffic and read the headers. You can do the same using tcpdump
Or run the following wget command to get the tomcat response header

Code:

wget -S tomcat.domain.com:8080

Regards