HOW TO: Mask IIS Version Information from Network Trace and Telnet
IN THIS TASK
back to the top
View Information from Network Packet Capturing SoftwareWhen you run a network trace on a client, capture TCP packets, and then make a GET request to an IIS server from that same client, the following is displayed as a result of the information that is captured in the response from the IIS server:
In IIS 4.0:
- Start a network trace from a client computer with a utility such as Network Monitor.NOTE: To set up your network tracing software, you must know the IP address of the Web server that you are making a request to.For additional information, click the article number below to view the article in the Microsoft Knowledge Base:252876 How to View HTTP Data Frames Using Network Monitor
- Use a Web browser to request a page from an IIS Web server.
- When the page that you requested is loaded in your browser, stop the capture, filter on HTTP protocol traffic, and review the results.The manufacturer of the operating system and the version of the software that the Web server is using are displayed in the first HTTP response frame from the IIS server. Look for the response frame from the server to the client that is using port port number.
View Information from a Telnet RequestWhen you use a command prompt to telnet to the HTTP port of the IIS Web server, the banner includes the following information:
If no banner is displayed immediately, press the ENTER key two times.
back to the top
Mask the Server Header InformationTo hide the server header information, download URLScan and then configure the Urlscan.ini file.
NOTE: The steps in this article only mask the server header information. This procedure does not prevent users from deducing from other information that is returned from Web pages that are served by an IIS Web server.
back to the top
Install URLScanURLScan, which you can install with the IIS Lockdown Tool, is an ISAPI filter that provides the Web server administrator with additional configuration options to secure the server. One configurable option is the RemoveServerHeader option. By default, this option is set to 0, or False.
To download the URLScan utility, visit the following Microsoft Web site:
For additional information about how to install and configure URLScan, click the article number below to view the article in the Microsoft Knowledge Base:
Edit the Urlscan.ini File
- Stop the IISAdmin service, which will also stop all of the services that are dependent on it, such as the World Wide Web Publishing Service.
- In My Computer, locate the Urlscan folder. By default, this is located at %systemroot%\System32\Inetsrv\Urlscan.
- In Notepad or another text editor, open the Urlscan.ini file.
- Locate the following entry:
- Modify this entry as follows:
- Save the file.
- Restart the World Wide Web Publishing service and all of the other services that were stopped when the IISAdmin service was stopped. Starting a service that runs under the IISAdmin service also starts the IISAdmin service.
Article ID: 317741 - Last Review: 07/07/2008 20:26:24 - Revision: 3.1
- kbhowtomaster KB317741