Hack Like a Pro: How to Fingerprint Web Servers Using Httprint « Null Byte :: WonderHowTo

Welcome back, my greenhorn hackers!Earlier inthis series, I showed a you a couple of different ways of fingerprinting webservers. Probably the easiest way, is to usenetcatand connect to port 80 and pull the webserver banner.The banner is simply the application advertising what it is. Webserver administrators who are vigilant and savvy about security will often suppress or masquerade their banners.In other words, to throw off hackers, they might replace the banner of, say, Microsoft's IIS 6.0 with a banner saying it is Apache 2.4.0. In that way, hackers will spend their time and effort trying to hack a relatively vulnerable IIS 6.0, get frustrated when it doesn't work, and eventually go away.Remember, exploits/hacks are specific to the application and operating system among many factors. That's why fingerprinting is SO important. A hack that works on IIS 6.0 will NOT likely work on Apache.In addition, some web administrators will put various load balancing and other devices designed to obscure the identity of the web server (Computer Associates advertises one their products with the tagline, "You can't hack what you can't see").Fortunately, there are more sophisticated ways of determining what web server is running a website.httpprintis just such a tool, which uses heuristics (an educated guess based upon incomplete, but probably sufficient data) to identify the web server as well as web enabled devices such as printers, routers, switches, etc.Step 1: Open HttprintLet's start by opening httprint. Unfortunately, the GUI in BackTrack points to the wrong directory, so we need to open a terminal and type:bt > cd /pentest/enumeration/web/httprint/linuxOnce we are in the correct directory, let's open the help screen in httprint../httprint -hAbout a third of the way down this help screen, you can see the basic syntax forhttprint, which is:httprint -h <host> -s signatures.txtWhere signatures.txt is text file in this directory that contains the signatures of the many types of web servers that httprint uses to determine the identity of the target.Step 2: Test It in CNN.ComLet's test it on cnn.com's website.bt > ./httprint -h 157.166.226.25 -P0 -s signatures.txtI have added theP0to suppress the ping (like when usingnmap) that often is blocked by network devices and will prohibit us from accessing the web server.As you can see above, httprint has fingerprinted the site and tells us that cnn.comreportsthat it is using the nginx webserver, but in reality, is running Microsoft IIS 6.0! Hmm...that is VERY INTERESTING!Reporting that you are running nginx is a good security strategy for cnn.com as there far fewer known vulnerabilities for nginx than IIS 6.0 This will help to divert most attackers, but not us!Step 3: Let's Try Craigslist.orgLet's try the same on craigslist.org.bt > ./httprint -h 208.82.238.129 -P0 -s signtaures.txthttprint tells us that craigslist.org's website shows a banner saying it is running Apache, but httprint thinks it is Oracle's Web Logic server. One interesting thing about httprint is that it also gives us a confidence level and here it says it is 27.71% confident. Not real high, so we'll take this one with a large grain of salt.Step 4: Finally, Let's Try Wikipedia.comLet's try one more site and see what httprint tells us. Let's point it at wikipedia.com.bt> ./httprint -h 208.80.154.224 -P0 -s signatures.txthttprint tells us that although Wikipedia says it is running Apache, it deduces with a 48.8% confidence that it is running Red Hat's TUX 2.0.Httprint is another tool in our arsenal of reconnaissance tools to decipher the nature of the target. These tools are critical as nearly every exploit is specific, so we MUST determine what we are attacking BEFORE we attack.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseFingerprintimage via ShutterstockRelatedHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)Advanced Nmap:Top 5 Intrusive Nmap Scripts Hackers & Pentesters Should KnowHow To:Fingerprint-Lock Apps on Android Without a Fingerprint ScannerHack Like a Pro:How to Hack Web Apps, Part 2 (Website Spidering with WebScarab)Hack Like a Pro:How to Hack Web Apps, Part 7 (Finding Hidden Objects with DIRB)How To:Lock Apps Using Your Samsung Galaxy S6’s Fingerprint ScannerHack Like a Pro:How to Conduct OS Fingerprinting with Xprobe2Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)How To:Use Your Fingerprint Scanner to Do Almost Anything with TaskerHow To:Lock Any App with a Fingerprint on Android MarshmallowHack Like a Pro:How to Use Netcat, the Swiss Army Knife of Hacking ToolsAndroid for Hackers:How to Scan Websites for Vulnerabilities Using an Android Phone Without RootCanvas Fingerprinting:How to Stop the Web's Sneakiest Tracking Tool in Your BrowserHack Like a Pro:How to Scan the Internet for Heartbleed VulnerabilitiesHow To:Hack Your Firefox User Agent to Spoof Your OS and BrowserNews:10 Great 99 Cent Apps You Need on Your Android Right NowHow To:Get the Pixel's Fingerprint Swipe Notification Gesture on Other DevicesAndroid Basics:How to Unlock Your Phone with Your FingerprintHow To:Turn Off Your Android's Screen with Your Fingerprint ScannerThe Sony Hack:Thoughts & Observations from a Real HackerNews:Researchers Find 'MasterPrints' That Can Bypass Your Phone's Fingerprint ScannerHack Like a Pro:How to Use PowerSploit, Part 1 (Evading Antivirus Software)How To:This Hack Lets You Touch Your Galaxy's Home Key Instead of Pressing ItNews:Latest Huawei Mate 20 Rumors & Leaks — Face ID, Massive Battery & Wireless ChargingNews:Samsung Scraps In-Display Fingerprint Scanner for Galaxy Note 8News:OnePlus 5 Looks to Have a Rear Fingerprint SensorHow To:Secure Any Android App with Your FingerprintHow To:Make the Fingerprint Scanner Work Faster on Your Galaxy DeviceHow To:Detect Vulnerabilities in a Web Application with UniscanHow to Hack Wi-Fi:Evading an Authentication Proxy Using ICMPTXHack Like a Pro:How to Use the New p0f 3.0 for OS Fingerprinting & ForensicsHack Like a Pro:How to Find Vulnerable Targets Using Shodan—The World's Most Dangerous Search EngineHacking Reconnaissance:Finding Vulnerabilities in Your Target Using NmapCommunity Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsGoodnight Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingCommunity Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsHow To:The Official Google+ Insider's Guide IndexHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesHow To:Run a Free Web Server From Home on Windows or Linux with Apache