This step-by-step article describes how to prevent the Internet Information Server (IIS) or Internet Information Services (IIS) version information that the server header contains from being displayed either in a network trace or from the results of a telnet command. To prevent this information from being displayed, you can implement URLScan, a free utility that is available at the Microsoft security Web site.back to the top View Information from Network Packet Capturing Software
When you run a network trace on a client, capture TCP packets, and then make a GET request to an IIS server from that same client, the following is displayed as a result of the information that is captured in the response from the IIS server:
In IIS 4.0:
HTTP: Server = Microsoft-IIS/4.0
In IIS 5.0:
HTTP: Server = Microsoft-IIS/5.0
To view this information:
back to the top View Information from a Telnet Request
- Start a network trace from a client computer with a utility such as Network Monitor.NOTE: To set up your network tracing software, you must know the IP address of the Web server that you are making a request to.For additional information, click the article number below to view the article in the Microsoft Knowledge Base:
How to View HTTP Data Frames Using Network Monitor
- Use a Web browser to request a page from an IIS Web server.
- When the page that you requested is loaded in your browser, stop the capture, filter on HTTP protocol traffic, and review the results.The manufacturer of the operating system and the version of the software that the Web server is using are displayed in the first HTTP response frame from the IIS server. Look for the response frame from the server to the client that is using port port number.
When you use a command prompt to telnet to the HTTP port of the IIS Web server, the banner includes the following information:
server: Microsoft -IIS/4-0
server: Microsoft -IIS/5.0
To perform a telnet request, type the following information at a command prompt:
telnet ip_address_of_web_server 80
Note the space between "telnet" and the IP address and the space between the IP address and "80".
If no banner is displayed immediately, press the ENTER key two times.back to the top Mask the Server Header Information
To hide the server header information, download URLScan and then configure the Urlscan.ini file.NOTE
: The steps in this article only mask the server header information. This procedure does not prevent users from deducing from other information that is returned from Web pages that are served by an IIS Web server.back to the top Install URLScan
URLScan, which you can install with the IIS Lockdown Tool, is an ISAPI filter that provides the Web server administrator with additional configuration options to secure the server. One configurable option is the RemoveServerHeader
option. By default, this option is set to 0, or False.
To download the URLScan utility, visit the following Microsoft Web site:
By default, URLScan is installed in %systemroot%\System32\Inetsrv\UrlScan directory.
For additional information about how to install and configure URLScan, click the article number below to view the article in the Microsoft Knowledge Base:
INFO: Availability of URLScan Version 2.5 Security Tool
To download the IIS Lockdown Tool, visit the following Microsoft Web site:back to the top Edit the Urlscan.ini File
back to the top
- Stop the IISAdmin service, which will also stop all of the services that are dependent on it, such as the World Wide Web Publishing Service.
- In My Computer, locate the Urlscan folder. By default, this is located at %systemroot%\System32\Inetsrv\Urlscan.
- In Notepad or another text editor, open the Urlscan.ini file.
- Locate the following entry:
- Modify this entry as follows:
- Save the file.
- Restart the World Wide Web Publishing service and all of the other services that were stopped when the IISAdmin service was stopped. Starting a service that runs under the IISAdmin service also starts the IISAdmin service.
telnet banner http ftp remove hide mask undisplay conceal screen cover withhold suppress