i am running a test server locally that is also broadcasted (for education purposed) on a mac and i ran a software called acunetix (www.acunetix.com) and from another computer and it was able to detect the technologies used on the server. how can i block anything from viewing this information?

  • ps: would anyone know an alternative to acunetix that can be ran on a mac? – user58067 Oct 24 '10 at 7:22

What information exactly are you trying to block ?

If you are talking about the server's signature, such as

Server: Apache/2.2.9 (Debian) PHP/5.2.6-1+lenny3 with Suhosin-Patch mod_ssl/2.2.9 OpenSSL/0.9.8g 

This is easily removable in httpd.conf by setting the following parameter

ServerTokens Prod
ServerSignature Off

Also, is it likely that PHP sets a header to expose its version, such as

X-Powered-By: PHP/5.2.6-1+lenny3

Which you can remove in your php.ini using the following parameter

expose_php = Off

But that won't block complete information gathering from softwares like acunetix. Those software are designed to gather any information they can from the HTML code your website returns down to the TCP Windows size of the network communication between the scanner and the server (not talking about domain and DNS queries, and so on). Information gathering is an entire field of computer security.


My answer to this question on Stack Overflow may be of some assistance.

It's important to realise that even if you cover all of the more obvious publicly visible signs of your implementation, it will still be possible for a sufficiently determined person to determine what environment is running. One possible way to do this would be to use TCP fingerprinting to determine a possible OS, and then to start exploring exploits based on that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy