Aerosol Posted June 4, 2015 Report Posted June 4, 2015 When performing a Web Application Security Assessment, an important step is Fingerprinting which allows for further exploitation by an attacker. So as a security researcher/pentester, we should do well at fingerprinting the web server, which gives lot of information like application name, software version, web server info, OS, and more. This helps for known vulnerabilities, researching vulnerabilities and exploiting.So here I will discuss some techniques which are required for this task:Finger Print MethodologyHow to perform this activity: obviously for an attacker there is no hard and fast rule to perform this operation. For pentesting we will discuss some methods below.HTTP Header Banner GrabbingThe most basic form of identifying a web framework is to gather the basic architecture like application name and server banner which will be more helpful for banner grabbing.Banner grabbing by Netcat:So we got AkamaiGhost, which is a load balancer that prevents finger printing.Banner grabbing by Telnet:Here we got a lot of information about the application and server for further exploitation.By Nmap:Using some Nmap command we can also enumerate information about application and web server finger printing. If you want to know more about Nmap please click here.By sending a malformed HTTP Header request/Junk requestReview by inspecting cookiesCrawling cookies can reveal lots of information about the application. See the below example:Host: resources.infosecinstitute.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateReferrer: http://www.google.co.in/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&ved=0CCYQjBAwAQ&url=http%3A%2F%2Fresources.infosecinstitute.com%2Fnmap-cheat-sheet%2F&ei=JCpCVaK1Mo-wuASe1YC4Cg&usg=AFQjCNFYlxcvuiEFw2QCg-9_e6R-M76_9Q&sig2=y9KWwXGOOQ_bVpfKw-fiaA&bvm=bv.92189499,d.c2E&cad=rjaCookie: __utma=192755314.2098953166.1427376874.1427376874.1427376874.1; __utmz=192755314.1427376874.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); visitor_id12882=216943492; __distillery=v20150227_1ce95eb6-6db3-422d-8dfe-497a0e3b3b7f; _ga=GA1.2.2098953166.1427376874; X-Mapping-fjhppofk=767BD7CA2B9E38F518B95F35B5326A01Connection: keep-aliveAutomation and Tools ImplementationHere we will discuss some of the tools which can be of further use for finger printing. We will discuss one by one.Whatweb:Currently Whatweb is the most important tool for finger printing in Kali Linux. It includes the below features:Text strings (case sensitive)Regular expressionsGoogle Hack Database queries (limited set of keywords)MD5 hashesURL recognitionHTML tag patternsCustom ruby code for passive and aggressive operationsSee the below screenshot.BlindElephant:Blind Elephant is an open-source generic web application finger printer that produces results by examining a small set of static files. Basically it is called static finger printing. It searches the file name for file extensions developed by the Python library and gives the finger print result.Fireup the below command to install:svn co https://blindelephant.svn.sourceforge.net/svnroot/blindelephant/trunk blindelephantFollow the below pictures:Scan the target with the below command:Plugin Support:With –p switch we can search for a plugin like the below command for WordPress:Blindelephant.py –s –p guess target pluginpython BlindElephant.py -u targetActually it scans for static files, version no, config file. A best candidate for finger printing is by checking the checksum of the file like with the hashing method. Some others are below:Css fileJs file.ini fileEn-GB ini file and many moreExtending support for PythonFrom a hacker’s perspective, we need customized finger printing and our function should support it. Though it is open source, we can do customization. Check the below snippet of code:$python>>> from blindelephant.Fingerprinters import WebAppFingerprinter>>>>>> #Construct the fingerprinter>>> #use default logger pointing to console; can pass "logger" arg to change output>>> fp = WebAppFingerprinter("http://laws.qualys.com", "movabletype")>>> #do the fingerprint; data becomes available as instance vars>>> fp.fingerprint()(same as above)>>> print "Possible versions:", fp.ver_listPossible versions: [LooseVersion ('4.22-en'), LooseVersion ('4.22-en-COM'), LooseVersion ('4.23-en'), LooseVersion ('4.23-en-COM')]>>> print "Max possible version: ", fp.best_guessMax possible version: 4.23-en-COMWappalyzerWebsite: WappalyzerWapplyzer is a Firefox Chrome plug-in. It works only on regular expression matching and doesn’t need anything other than the page to be loaded on the browser. It works completely at the browser level and gives results in the form of icons. Sometimes it may a be false positive, so be careful when using this tool.Desenmascara.meThis is online tool for extracting information. It reveals lots of info including web server info, application info and known vulnerabilities.httprint – the advanced HTTP fingerprinting engineThis uses static analysis with a signature file that contains a different header file for different types of servers../httprint -s signatures.txt -o apache1.html -h apache.example.coms-signature for different http headero-output to a fileh-host fileHTTP Reconhttprecon project / downloadThis is all in one project which provides finger printing and reporting. It involves five tabs which help security testers to refine the results during finger printing. See the image below.We got lots of information from here.NetCraftAnother all in one tool is NetCraft, which is an online tool. We can grab various information by using this tool.Netcraft Extension - Phishing Protection and Site ReportsReferencesAn Introduction to HTTP FingerprintingWappalyzerhttp://blindelephant.sourceforge.net/Source Quote
