HTTPRecon (Server Fingerprint)
Perform a new query
Enter any HTTP URL you would like to perform HTTPRecon (Web-server fingerprinting) on. (i.e. www.google.com or 8.8.8.8)
HTTPRecon or HTTP Fingerprinting is a tool developed by computec.ch and modified by w3dt to help return highly accurate identification of given httpd implementations. This is very important within professional vulnerability analysis.
HTTPRecon improves the easiness and efficiency of Server HTTP Fingerprinting / Identification and this kind of enumeration. Traditional approaches such as banner-grabbing, status code enumeration and header ordering analysis are used, however many other analysis techniques have been introduced to HTTPRecon to help increase the possibilities of accurate web server fingerprinting. Some of these methods have been discussed in the book "Die Unset des Penetration Testing" (Chapter 9.3, HTTP-Fingerprinting, pp. 530-550).
The following picture illustrates the architecture of the whole HTTPRecon framework. The scan engine uses nine different requests which are sent to the target web server. These provoke the response which can be used for the fingerprinting and there are different kind of requests used. Some of them are very common and legitimate (i.e. GET / HTTP/1.1) and others are usually not accepted due to their malicious nature (i.e. a very long URI in a GET request).
The possibility of fingerprinting is not a vulnerability in a traditional way which allows to compromise a host. It is more a flaw or exposure which may provide the foundation for further enumeration and specific attack scenarios. Nevertheless, applying some counter-measures to harden a service is always a good idea. Preventing fingerprinting 100 % is not possible due to the nature of interaction between network software. But there are possibilities to decrease the accuracy of such an analysis.
More information about this project, downloadable versions & sources can be found online at the httprecon project page.
The w3dt HTTPRecon (HTTP Web-server Fingerprinting Tool) is authored by Marc Ruef and maintained for w3dt.net by David Nedved - See computec.ch for more information.
