[Full-Disclosure] [ANNOUNCE]: IISBanner 1.0

From: Tiago Halm (thalm_at_netcabo.pt)
Date: 06/19/03

  • Next message: Denis Dimick: "Re: [Full-Disclosure] Linux firewall" 
    To: <full-disclosure@lists.netsys.com>
Date: Thu, 19 Jun 2003 02:32:04 +0100

    ============== IISBanner ==============
    Type: ISAPI Filter
    Open Source: Yes
    License: BSD

    Description
    --------------
    We are proud to present a tool with the ability to change the IIS Response
    Header "Server".

    ISAPI Filters are the only "safe" way of managing (changing, altering,
    customizing) some of the core parts of IIS. Customizing the response header
    "Server" is one of those tasks. IISBanner provides a simple yet powerful,
    although demonstrative, way of achieving such objective. IISBanner may be
    useful at a security prespective by disguising the web server banner
    (security by obscurity), but keep in mind that there are much more powerfull
    ways of detecting a server type using tools like nmap.

    Features
    -----------
    Changes IIS "Server" response header value to "Powered By IISBanner/1.0
    (KodeIT)"

    Notes
    -------
    Instalation of this ISAPI Filter must be done at the WebServer level;
    Although the Response Value could be set in a file (ex: ini), I decided to
    "hard code" it to make it simple to understand the source code; IISBanner is
    installed at http://www.kodeit.org and may be viewed by a network sniffer at
    each HTTP response received, or through this simple VBS script: ... Set
    oHTTP = WScript.CreateObject("Microsoft.XMLHTTP")
    Call oHTTP.Open("HEAD", "http://www.kodeit.org", False)
    Call oHTTP.Send()
    WScript.Echo oHTTP.GetAllResponseHeaders()
    Set oHTTP = Nothing
    ...

    Remarks
    -----------
    With the objective of providing a demonstrative feature, the current version
    of this tool is not configurable. Depending on comments (hopefully)
    provided, one such configurable version may be built along with some other
    features added.

    IISBanner can be downloaded from http://www.kodeit.org/utils/iisbanner.htm

    Cheers,
    Tiago Halm

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Denis Dimick: "Re: [Full-Disclosure] Linux firewall"

    Relevant Pages

    • [NT] Port80 Software ServerMask Inconsistencies
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... IIS servers by obfuscating header fields within HTTP responses: ... "ServerMask 2.0 removes or modifies unnecessary response data. ... provide reliable clues to the server being Microsoft IIS. ...
      (Securiteam)
    • Re: Unfiltered Header Injection in Apache 1.3.34/2.0.57/2.2.1
      ... "Expect" header. ... In Apache 2.0.x and 2.2.x, the 417 response will be sent by the server ...
      (Bugtraq)
    • [Full-Disclosure] [ANNOUNCE]: IISBanner 1.0
      ... We are proud to present a tool with the ability to change the IIS Response ... Customizing the response header ... "Server" is one of those tasks. ...
      (Full-Disclosure)
    • How do you hide the HTTP Server header?
      ... taking care of a whole variety of security issues in IIS. ... But if you just want to anonymize your IIS box by removing ... I don't know if URLScan's header manipulation has any ... how do you hide the HTTP server ...
      (microsoft.public.inetserver.iis.security)
    • Re: Hiding server name in HTTP HEAD
      ... You can use URLScan to remove the "Server:" response header of structured ... the ones sent through unstructured responses, you'd have to parse HTTP ...
      (microsoft.public.inetserver.iis)