Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How to scan my server remotely? I want to scan a website, so my server, and gathered information related to webserver and other software associated info. I got one named blindelephant . But it is not serving my purpose.

Webserver related info: Which server serving the app? what is the version? etc

software associated info: What are the software or tool used by the application. What are their version?

I am trying to build a vulnerability assessment tool for that i need to know the web server and software packages used to run a website or web application.

Say: A script will take and find the web server info(which @ABS has almost answered) and external software packages dependencies to run

Hope it helps!

share|improve this question

closed as off topic by Ladadadada, MikeyB, RobM, Ward, MDMarra Feb 24 '12 at 23:42

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Vulnerability assessment is something best left to the experts honestly. You should probably be looking for a service or website to do this. Unless you have time to keep up with the constantly evolving threats on the Internet your tool will be outdated before it's finished. – Chris S Feb 23 '12 at 13:46
I'm not sure if this might fit better on Security.SE or StackOverflow. Could you clarify whether you are writing a scanning tool or looking for one to use on your own site? – Ladadadada Feb 23 '12 at 13:52
I am thinking of writing my own. – Tauquir Feb 23 '12 at 14:17
If you have to ask how, you'll probably struggle but don't let us stop you then. – RobM Feb 23 '12 at 19:00
up vote 3 down vote accepted

There already are vulnerability assessment frameworks available, like Nessus and SAINT. You would get another host outside your network, like from a home connection or using Amazon's EC2 service, install the tools, and run them against your own website.

EDIT - if you're going to write your own, look at open source software to tell you how they do it, like using OS fingerprinting in NMap and the plugins for Nessus/SAINT type applications. Then read books on reverse-engineering malware and study how they work to do your own original take on it. Malware is an ever-changing field and most conventional techniques are well documented in existing auditing frameworks (some of them are used by blackhats to create more script-kiddie tools, if that tells you anything).

This all depends on whether you're doing it just to do it, or if you're trying to make a genuinely useful program/service. If you're doing it on your own for fun, more power to you. If you just decided one day to do this as a service/application to sell, you might want to reconsider. Security isn't easy, and there is a certain amount of trust placed in tools used by people.

share|improve this answer
I would definitely add W3AF to that list. It's open source and already written in Python. – Ladadadada Feb 23 '12 at 15:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.