Security

Re: hiding/suppressing http headers

zerkat — Mon, 30 Jun 2008 12:06:08 GMT

oh.....thanks....That makes sense. Probably something I should have already known. oh well, we all have those moments.

Re: hiding/suppressing http headers

wadeh — Fri, 27 Jun 2008 20:19:49 GMT

UrlScan can do this by setting RemoveServerHeader=1.

If I understand correctly how you are trying to test this, I believe that your test is not valid. The SOFTWARE_VERSION, REMOTE_PORT, etc. server variables visible in ASP are not response headers.

The proper way to test this is to use a sniffer tool to look at bits on the wire or a test client like wfetch that can show you the raw headers that the server returned.

Thanks,

-Wade

hiding/suppressing http headers

zerkat — Fri, 27 Jun 2008 19:24:39 GMT

Is there a way to suppress the server software from being returned in the header? I am running IIS 6.

I installed URLScan which will suppress the server header but the software version and ports still display. I have an ASP page that will return everything in the header to double check. Is there another tool or software that would accomplish this?

Any advice on this matter would be greatly appreciated.