Webサーバのフィンガープリンティングツールのhttprintの新バージョンがリリースされてるようです。
# [new] Multi-threaded engine. httprint v301 is a complete re-write, featuring a multi-threaded scanner, to process multiple hosts in parallel. This greatly saves scanning time. *multi-threading is not yet supported in the FreeBSD version.
# [new] SSL information gathering. httprint now gathers SSL certificate information, which helps you identify expired SSL certificates, ciphers used, certificate issuer, and other such SSL related details.
# [new] Automatic SSL detection. httprint can detect if a port is SSL enabled or not, and can automatically switch to SSL connections when needed.
パフォーマンスとSSLサポートが向上しています。
ちなみに手元のLinux/Apache2に対して57.23%の確立でApache2であると判定しました。本気で隠そう、とまでは思っていないですが単純なスキャンでは分かりづらいくらいには隠そうとしていてこの結果です。まずまずの検知性能と思います。
OSもそうですが、隠しているつもりでも隠れていない場合も結構あるので気になる方は試してみてはいかがでしょうか?
# OSならnmapが定番のフィンガープリンティングツールです。念の為。
試しに実行してみたhttprintのアクセスログは次の通りです。
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “GET / HTTP/1.0” 200 15036 “-” “-”
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “GET / HTTP/1.0” 200 15036 “-” “-”
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “OPTIONS * HTTP/1.0” 200 – “-” “-”
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “OPTIONS / HTTP/1.0” 200 15036 “-” “-”
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “GET /antidisestablishmentarianism HTTP/1.0” 404 7556 “-” “-”
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “PUT / HTTP/1.0” 200 15036 “-” “-”
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “JUNKMETHOD / HTTP/1.0” 200 15036 “-” “-”
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “GET / JUNK/1.0” 200 15036 “-” “-”
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “get / http/1.0” 200 15036 “-” “-”
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “POST / HTTP/1.0” 200 15036 “-” “-”
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “GET /cgi-bin/ HTTP/1.0” 403 7556 “-” “-”
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “GET /scripts/ HTTP/1.0” 404 7556 “-” “-”
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “GET / HTTP/1.1” 200 15036 “-” “-”
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “GET / HTTP/1.2” 200 15036 “-” “-”
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “GET / HTTP/3.0” 200 15036 “-” “-”
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “GET /.asmx HTTP/1.1” 404 7556 “-” “-”
192.168.100.210 – – [25/Dec/2005:05:43:29 +0900] “GET /../../ HTTP/1.0” 400 226 “-” “-“
Leave a Comment