Web Application Defender's Cookbook

Recipe 6-2: Detecting Response Header Information Leakages

This recipe shows you how to find and remove sensitive technical data exposed in response headers.

Ingredients

• Apache
  • ServerTokens directive
  • Header directive

• ModSecurity
  • SecServerSignature directive

Much like we can analyze inbound request header data to identify probable client software being used to interact with our application, attackers can inspect response header data to glean valuable intelligence. Web applications often leak technical details about our web application software versions and configurations. Let’s take another look at the response header data from the previous recipe:

HTTP/1.1 200 OK
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 5765

The bold response header data shows that the web application is running Microsoft’s ASP.NET software (X-Powered-By) and the specific version information (X-AspNet-Version). The fact that the web application is running ASP.NET might not be that sensitive, because it would be easy to conclude this simply by looking for file extensions such as .asp or .aspx. However, the detailed version information is potentially troubling. Providing this level of detail to an attacker allows him to more quickly identify likely exploits to attempt. Let’s look at another response:

HTTP/1.1 200 OK
Date: Wed, 02 May 2012 17:01:22 GMT
Server: Apache/2.2.14 (Ubuntu) mod_mono/2.4.3 PHP/5.3.2-1ubuntu4.5 ...