The httprecon project is doing some research in the field of web server fingerprinting, also known as http fingerprinting. The goal is the highly accurate identification of given httpd implementations. This is very important within professional vulnerability analysis.
Besides the discussion of different approaches and the documentation of gathered results also an implementation for automated analysis is provided. This software shall improve the easiness and efficiency of this kind of enumeration. Traditional approaches as like banner-grabbing, status code enumeration and header ordering analysis are used. However, many other analysis techniques were introduced to increase the possibilities of accurate web server fingerprinting.
Besides the well-known enumeration of http response status codes and header-ordering several other fingerprinting mechanisms were introduced. For example the capitalization of header lines, the use of spaces and the structure of ETag values (e.g. length and quotes).
There are nine test cases in which the behavior of the target service ismapped. These are:
* legitimate GET request for an existing resource
* very long GET request (>1024 bytes in URI)
* common GET request for a non-existing resource
* common HEAD request for an existing resource
* allowed method enumeration with OPTIONS
* usually not permitted http method DELETE
* not defined http method TEST
* non-existing protocol version HTTP/9.8
* GET request including attack patterns (e.g. ../ and %%)
This increases the amount of fingerprints to distinguish the given implementation. Thus, the accuracy of the fingerprinting series is very high. Theoretically httprecon 1.x is able to generate approx. 198 fingerprint atoms per full scan run (usually between 80 and 120 are given).
0 comments
Post a Comment