Web Server Version Revealed (IIS)

During a recent penetration test we were notifed that the following was
happening.

Web Server Version Revealed (IIS) and the recommendation was to use a generic
webserver name so as the server is not targeted for known vulnerabilities.

These are on Windows Server 2003.

The question I have is how do I do this.

Anyone that can help please let me know.

Bernard
Wed Nov 22 22:53:22 CST 2006

Are you referring to the banner information?
Yes, you are able to change it. but do you think it will protect the server?

Most attack script now crawling the net, hitting your box with all possible
ways of attacks. do you think it will stop when it see that 'not iis
banner', then stop?

and what did those penetration guys tell you?
change the name and will protect it forever?

--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/


"dsmoody" <u29464@uwe> wrote in message news:69af3de1dd3a3@uwe...
> During a recent penetration test we were notifed that the following was
> happening.
>
> Web Server Version Revealed (IIS) and the recommendation was to use a
> generic
> webserver name so as the server is not targeted for known vulnerabilities.
>
> These are on Windows Server 2003.
>
> The question I have is how do I do this.
>
> Anyone that can help please let me know.
>

Daniel
Thu Nov 23 05:50:59 CST 2006

dsmoody wrote on Wed, 22 Nov 2006 21:03:34 GMT:

> During a recent penetration test we were notifed that the following was
> happening.
>
> Web Server Version Revealed (IIS) and the recommendation was to use a
> generic webserver name so as the server is not targeted for known
> vulnerabilities.
>
> These are on Windows Server 2003.
>
> The question I have is how do I do this.
>
> Anyone that can help please let me know.

"Security through obscurity" is generally a waste of time. As Bernard
pointed out, most scripted hacks don't even bother checking what server
software is being run.

Dan

dsmoody
Thu Nov 23 07:35:03 CST 2006

yes I understand that but my client is asking for this and in order to gain
the business i need to do it. So with that said can anyone tell me how to do
this?



Daniel Crichton wrote:
>dsmoody wrote on Wed, 22 Nov 2006 21:03:34 GMT:
>
>> During a recent penetration test we were notifed that the following was
>> happening.
>[quoted text clipped - 8 lines]
>>
>> Anyone that can help please let me know.
>
>"Security through obscurity" is generally a waste of time. As Bernard
>pointed out, most scripted hacks don't even bother checking what server
>software is being run.
>
>Dan

--
Message posted via WinServerKB.com
http://www.winserverkb.com/Uwe/Forums.aspx/iis-general/200611/1

Daniel
Thu Nov 23 09:28:57 CST 2006

dsmoody wrote on Thu, 23 Nov 2006 13:35:03 GMT:

> yes I understand that but my client is asking for this and in order to
> gain the business i need to do it. So with that said can anyone tell me
> how to do this?

You can use the URLScan add-on from MS:

http://www.microsoft.com/technet/security/tools/urlscan.mspx#EXE

While this is intended for pre-IIS6, it will allow the additional options
that were not built-in to IIS6 to be used such as removing the server
header.

Dan

Bernard
Thu Nov 23 21:56:35 CST 2006

why not give them the full package?
customize all services ? <g>
FIX: You cannot suppress the default FTP banner for the FTP service
http://support.microsoft.com/?id=826270
XCON: How to Modify the SMTP Banner
http://support.microsoft.com/?id=281224



--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/


"Daniel Crichton" <msnews@worldofspack.com> wrote in message
news:evMLZQxDHHA.2080@TK2MSFTNGP04.phx.gbl...
> dsmoody wrote on Thu, 23 Nov 2006 13:35:03 GMT:
>
>> yes I understand that but my client is asking for this and in order to
>> gain the business i need to do it. So with that said can anyone tell me
>> how to do this?
>
> You can use the URLScan add-on from MS:
>
> http://www.microsoft.com/technet/security/tools/urlscan.mspx#EXE
>
> While this is intended for pre-IIS6, it will allow the additional options
> that were not built-in to IIS6 to be used such as removing the server
> header.
>
> Dan
>