312-50 Question 282
Single answer▪ Web Server ConceptsDuring an authorized assessment, you need to identify the web server software and version running on a target without relying on a simple banner grab, because the administrators may have modified or suppressed the Server header. Which approach is the most reliable for fingerprinting the web server in this situation?
- A
Use an HTTP fingerprinting tool such as httprint or a similar signature-based method that analyzes response behavior, headers, and status code patterns
- B
Rely only on a DNS zone transfer to determine the exact web server software and version
- C
Use a TCP SYN scan alone, because open ports uniquely identify the web server product and version
- D
Assume the server is Apache if port 80 is open and IIS if port 443 is open
Show answer and explanation
Correct answer: A
Explanation
This question tests practical understanding of web server fingerprinting, a core web server concept in CEH. In real environments, administrators often hide or alter the Server header to reduce information disclosure. Ethical hackers therefore use application-layer fingerprinting rather than trusting banners alone. Signature-based tools and techniques compare response characteristics across different request types to infer the server software more reliably. This aligns with common reconnaissance and enumeration practices described in penetration testing methodologies and web server hardening guidance. From a best-practice perspective, administrators should minimize banner disclosure, but assessors should know that obscuring headers does not prevent fingerprinting through behavioral analysis. Relevant references include OWASP guidance on information gathering and server header exposure, as well as vendor documentation for HTTP server configuration and response behavior.
- A. Correct.
Correct. When banner information is missing or intentionally altered, HTTP fingerprinting is the preferred approach. Tools such as httprint and similar techniques identify web servers by examining how they respond to malformed requests, specific HTTP methods, unusual headers, default error pages, status code behavior, and protocol quirks. This is a practical CEH-relevant technique because it works even when administrators suppress or modify obvious identification strings.
- B. Incorrect.
Incorrect. A DNS zone transfer, if misconfigured and allowed, can reveal hostnames and DNS records, but it does not directly determine the exact web server software and version. It is a useful reconnaissance technique, but it is not a reliable method for fingerprinting the web server application itself.
- C. Incorrect.
Incorrect. A TCP SYN scan can identify open ports and sometimes infer services, but ports alone do not uniquely identify the exact web server product or version. Multiple web servers can listen on the same ports, and version detection requires additional application-layer analysis beyond a basic SYN scan.
- D. Incorrect.
Incorrect. This is a common misconception. Port 80 and port 443 indicate HTTP and HTTPS services, not a specific vendor or product. Apache, Nginx, IIS, Lighttpd, and others can all serve traffic on either port, so this assumption is not valid.