Webserver stuff
By gregoire on Tuesday 21 July 2009, 01:04 - Permalink
Wow... In my everlasting quest to learn new ServerSignature strings when
surfing on the web, I used to Telnet_80 some random hostnames I'm used to
paying visits to.
Nothing fancy here, really.
Then I became curious about which servers were the most used.
O Hai! I can haz toolbox ?
First thing was to find a set of tools, widgets, plugins, things that suck
ram and displays what I'm looking for in the laziest way possible, because this
after all has to remain funny.
First tool is telnet. Here's an example:
gregg@centralperk:~$ telnet www.facebook.com 80 Trying
69.63.184.143... Connected to www.facebook.com.
Escape character is '^]'. HEAD / HTTP/1.1
host: localhost HTTP/1.1 302
Found Date: Mon, 20 Jul 2009 22:34:18 GMT
Server: Apache/1.3.41.fb2 Location:
http://www.ocalhos.ocalhost/common/browser.php Connection:
close Content-Type: text/html; charset=utf-8
Connection closed by foreign host.
Well, yeah, that's the BOFH way - painfull, h4x0rZ and not eyecandy at all. On
top of that, you would forget to set the host string every second
attempt, and would get no response just because of that.
Big up here for the facebook sys architects here that found important to
mention they had patched Apache. (...to the morons that found important to read
their server header, and obviously I belong to that aforementioned
category of deviants).
Well, that being said, it is not handy at all, so I found something else.
After messing a bit with buggy expect scripts of my own to automate that, I
found this kneat Firefox Extension that does it for you, all the time,
and displays the result in your status bar. Me likey !
Now I can't help, whenever I go to a website, I'd take a quick look at what
ServerSignature string it is sending in its HTTP headers.
O Hai ! I can haZ statz ?
Now the thing I was interested in was to see some actual stats on what
WebServers were used and a few comments on why if available.
Again, the folks from Netcraft - by the way hats off to you folks for the excellent work
you've been doing this past decade with NetCraft - have gathered some precious data around that.
The google webserver army
At some point, I came accross this blog post from dotcomunderground.com which
is particularly interesting, as it lists all webservers used by most of
Google's ASP apps.
Useless, but definitely worth reading :)
Conclusion
As a conclusion, there is some pretty amazing stuff to be learned by just
paying close attention to tiny details. Very likely, one would prefer one
webserver instead of another for pragmatic reasons, which is the reason why it
is always good to know what alternatives you've got. This is how you'll
certainly one day evaluate the likes of Nginx, Resin, thttpd... because each
one of these might have its specificities that makes it worth using.
Eventually, you'll come across funny stuff, such as people trying to show off
by stating their webserver is a KitchenAid2000 running on a Whirlpool IP OS
12.5 to state their l33tness out loud, but if there's one thing for
certain: turning your ServerSignature off is a good security measure, and
setting it to a fancy value brings attention, so you might not want to stand
out in the crowd an get pwnd just for fun of it :)
Oh and yeah, I found particularly funny that USA's NSA's website runs on Microsoft-IIS/6.0
servers. Maybe it's just a part of it, but I can't help thinking that if I
wanted a honeypot, I'd use that ServerSignature on it.