Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question is related to security of a website.

I know that web servers give information as if it was a pride (mostly in header form yet also in error pages as well). In this case, IIS (dev. version though) gives me this information when running into a 404:

Version Information: Microsoft .NET Framework Version:2.0.50727.4206; ASP.NET Version:2.0.50727.4209

Did any of you used a so called "exploit" in the past?
Yea, these little apps that are used to hack a server (or whatever). They mostly rely on server version, OS type etc'.

Giving such information is horrible in my opinion!

So my question is this: I want the server to reply with as less as possible information regarding itself, the operating system or whatever, in any scenario (successful page view, internal error, page not found etc').
How do I do that with IIS7? Is there a "stealth mode" for the server-side? Any good tutorial out there?

share|improve this question
up vote 1 down vote accepted

Changing server banners is pointless in the real world. You'll either fall prey to automated attacks that hit without checking, or a human attacker for whom OS and application fingerprinting is trivial through active and passive traffic examination.

If you're dead set on changing your banners, however, Microsoft's URLScan tool will do the trick:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.