QQ登录

只需要一步,快速开始

 注册地址  找回密码
查看: 6815|回复: 0
打印 上一主题 下一主题

如何叫你的apache不回显版本

[复制链接]
字体大小: 正常 放大
韩冰        

823

主题

3

听众

4048

积分

我的地盘我做主

该用户从未签到

发帖功臣 元老勋章

跳转到指定楼层
1#
发表于 2004-10-5 18:21 |只看该作者 |倒序浏览
|招呼Ta 关注Ta

作者:Yiming Gong , T6 e1 |2 y" D8 _# ]* ^+ H, A8 F' whttp://security.zz.ha.cn

/ V8 x8 m# J# j$ \6 b8 Y

默认情况下apache是会给client端回显版本号码的,可以测试如下,在client端使用nc联接起着apache的目的主机80端口,发送错误的get请求

4 ^! `) e! W6 m! ]% f7 `

yiming# nc security.zz.ha.cn 80 9 W6 O" u3 E! W* @+ Cget index.lakdsjf $ A9 z. ?5 m) Q+ k- `<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">/ u9 m4 U9 v4 ^8 f) U2 k6 z <html><head> ( z) k( G9 V, c& i, q! S<title>400 Bad Request</title> : J8 M' _0 I7 B* a9 p, u</head><body>2 r% F+ r G6 P$ \ <h1>Bad Request</h1> M' M( j$ ^: I7 a8 m! e<p>Your browser sent a request that this server could not understand.<br /> ; Q2 m" |# l( O* D</p>3 X" |2 n4 j( {* j <hr />! [8 d$ ]% F7 q$ ]% P: ?3 s <address>Apache/x.y.z Server at security.zz.ha.cn Port 80</address> : a+ h' |; [, W, m+ q2 N+ S</body></html>

* q6 N# Y. `4 Q7 A0 r& M% w) i) b

2 G8 Q5 n2 P3 z7 H% p 我们看到上面显示了apache的版本号(:) 俺隐去了真实版本),这可不太好,能修改一下么? # F: V) d9 ]7 \" z3 f答案是肯定的!8 ]; x6 i( q3 Z, ?+ d/ q& ?* u 改动apache的配置文件,找到ServerTokens和ServerSignature两个directive,修改默认属性: + g8 I. @3 {4 ~如下

* ` V; m' m4 `) i5 G# @

# and compiled in modules.1 L# i) k! Y, `( {/ r k #! R' g2 ^1 c- l+ M7 D% D # ServerTokens; ~5 _2 x6 Q1 J: v # This directive configures what you return as the Server HTTP response$ ]/ I8 v4 h2 F9 h \! i$ |$ N # Header. The default is 'Full' which sends information about the OS-Type% s$ s9 R" @+ X6 s$ q" L # and compiled in modules. 8 R4 h2 c! _$ u t# Set to one of: Full | OS | Minor | Minimal | Major | Prod & @/ E; K" K o% J* O# where Full conveys the most information, and Prod the least.& A) j% I, a- [' ` # 2 N9 f' S# b- i. W* R#ServerTokens Full3 P$ S4 s- G2 B6 |: `+ ^ ServerTokens Prod

8 R0 H6 g( L5 W8 y3 m

# / p2 L4 d3 N8 i* ^+ T1 ?0 x# Optionally add a line containing the server version and virtual host9 h; y2 i; S- [ e, [) @ # name to server-generated pages (internal error documents, FTP directory " V8 F* |, X) `) ~8 `" W6 M# listings, mod_status and mod_info output etc., but not CGI generated8 |* @* G7 s/ u/ n # documents or custom error documents). $ @' h3 [, G, D3 M# Set to "EMail" to also include a mailt link to the ServerAdmin. - L3 G* I, h0 Q4 r# Set to one of: On | Off | EMail 2 _) e6 Z/ F- X# \# L/ j$ p4 Q7 W" z#0 B. f' B& J+ I5 b5 w% f! r/ U ServerSignature On $ B+ c. t- b) `& vServerSignature Off

$ d( Y3 w( m2 m; I4 V

修改后重起apache,再看看, ( V0 x& |4 x/ p) iyiming# nc security.zz.ha.cn 80 ! T. Q+ ?* H# L; I1 p! H6 ?( c1 eget index.lakdsjf ) Y) A1 ~0 A2 c( r/ t<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">0 W& q4 P( E" k9 @ <html><head>' H8 y4 g3 A' W( t! A <title>400 Bad Request</title>/ _( h: e) w8 D </head><body># M% O% _- H: t- f4 I) c7 P2 V <h1>Bad Request</h1>) T; p# d* W: _7 W* o( n <p>Your browser sent a request that this server could not understand.<br /> 0 t( U3 }% L' E y</p>9 o$ |% m- G |3 Y6 e: o </body></html>

! J. x( M( E0 r6 R! ~5 M7 U

7 X% Z& W% f0 O5 B

zan
转播转播0 分享淘帖0 分享分享0 收藏收藏0 支持支持0 反对反对0 微信微信
您需要登录后才可以回帖 登录 | 注册地址

qq
收缩
  • 电话咨询

  • 04714969085
fastpost

关于我们| 联系我们| 诚征英才| 对外合作| 产品服务| QQ

手机版|Archiver| |繁體中文 手机客户端  

蒙公网安备 15010502000194号

Powered by Discuz! X2.5   © 2001-2013 数学建模网-数学中国 ( 蒙ICP备14002410号-3 蒙BBS备-0002号 )     论坛法律顾问:王兆丰

GMT+8, 2026-8-26 19:42 , Processed in 0.410348 second(s), 52 queries .

回顶部