Fingerprinting: Identifying Applications

When performing a Web Application Security Assessment, an important step is Fingerprinting which allows for further exploitation by an attacker. So as a security researcher/pentester, we should do well at fingerprinting the web server, which gives lot of information like application name, software version, web server info, OS, and more. This helps for known vulnerabilities, researching vulnerabilities and exploiting.So here I will discuss some techniques which are required for this task:

Finger Print Methodology

How to perform this activity: obviously for an attacker there is no hard and fast rule to perform this operation. For pentesting we will discuss some methods below.

HTTP Header Banner Grabbing

The most basic form of identifying a web framework is to gather the basic architecture like application name and server banner which will be more helpful for banner grabbing.

Banner grabbing by Netcat:

So we got AkamaiGhost, which is a load balancer that prevents finger printing.

Banner grabbing by Telnet:

Here we got a lot of information about the application and server for further exploitation.

By Nmap:

Using some Nmap command we can also enumerate information about application and web server finger printing. If you want to know more about Nmap please click here.

By sending a malformed HTTP Header request/Junk request

Review by inspecting cookies

Crawling cookies can reveal lots of information about the application. See the below example:

Host: resources.infosecinstitute.com

1
2
3
4
5
6
7
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: __utma=192755314.2098953166.1427376874.1427376874.1427376874.1; __utmz=192755314.1427376874.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); visitor_id12882=216943492; __distillery=v20150227_1ce95eb6-6db3-422d-8dfe-497a0e3b3b7f; _ga=GA1.2.2098953166.1427376874; X-Mapping-fjhppofk=767BD7CA2B9E38F518B95F35B5326A01
Connection: keep-alive

Automation and Tools Implementation

Here we will discuss some of the tools which can be of further use for finger printing. We will discuss one by one.

Whatweb:

Currently Whatweb is the most important tool for finger printing in Kali Linux. It includes the below features:

  • Text strings (case sensitive)
  • Regular expressions
  • Google Hack Database queries (limited set of keywords)
  • MD5 hashes
  • URL recognition
  • HTML tag patterns
  • Custom ruby code for passive and aggressive operations

See the below screenshot.

BlindElephant:

Blind Elephant is an open-source generic web application finger printer that produces results by examining a small set of static files. Basically it is called static finger printing. It searches the file name for file extensions developed by the Python library and gives the finger print result.

Fireup the below command to install:

Follow the below pictures:

Scan the target with the below command:

Plugin Support:

With –p switch we can search for a plugin like the below command for WordPress:

1
2
Blindelephant.py –s –p guess target plugin
python BlindElephant.py  -u target

What Actually Happens:

Actually it scans for static files, version no, config file. A best candidate for finger printing is by checking the checksum of the file like with the hashing method. Some others are below:

  • Css file
  • Js file
  • .ini file
  • En-GB ini file and many more

Extending support for Python

From a hacker’s perspective, we need customized finger printing and our function should support it. Though it is open source, we can do customization. Check the below snippet of code:

1
2
3
4
5
6
7
8
9
10
11
12
13
$python
>>> from blindelephant.Fingerprinters import WebAppFingerprinter
>>>
>>> #Construct the fingerprinter
>>> #use default logger pointing to console; can pass "logger" arg to change output
>>> fp = WebAppFingerprinter("http://laws.qualys.com", "movabletype")
>>> #do the fingerprint; data becomes available as instance vars
>>> fp.fingerprint()
(same as above)
>>> print "Possible versions:", fp.ver_list
Possible versions: [LooseVersion ('4.22-en'), LooseVersion ('4.22-en-COM'), LooseVersion ('4.23-en'), LooseVersion ('4.23-en-COM')]
>>> print "Max possible version: ", fp.best_guess
Max possible version:  4.23-en-COM

Wappalyzer

Website: http://wappalyzer.com

Wapplyzer is a Firefox Chrome plug-in. It works only on regular expression matching and doesn’t need anything other than the page to be loaded on the browser. It works completely at the browser level and gives results in the form of icons. Sometimes it may a be false positive, so be careful when using this tool.

Desenmascara.me

This is online tool for extracting information. It reveals lots of info including web server info, application info and known vulnerabilities.

httprint – the advanced HTTP fingerprinting engine

This uses static analysis with a signature file that contains a different header file for different types of servers.

1
2
3
4
./httprint -s signatures.txt -o apache1.html -h apache.example.com
s-signature for different http header
o-output to a file
h-host file

HTTP Recon

http://www.computec.ch/projekte/httprecon/?s=download

This is all in one project which provides finger printing and reporting. It involves five tabs which help security testers to refine the results during finger printing. See the image below.

We got lots of information from here.

NetCraft

Another all in one tool is NetCraft, which is an online tool. We can grab various information by using this tool.

http://toolbar.netcraft.com

So finally we are done with the tutorial. Let me know if you have any further questions.

References

http://www.net-square.com/httprint_paper.html

http://wappalyzer.com

http://blindelephant.sourceforge.net/

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

StormSecurity

IT Security Research and Services

govolution

About assembler and stuff

Astr0baby's not so random thoughts _____ rand() % 100;

ψυχῆς ἰατρεῖον "Hospital of the soul"

Penetration Testing Academy

Education and Advice for Rookies

P.M.C.S.P. Blog

Articles about Physics, Math, Computer Security & Programming and more

Chimera | Security

#YorkshireAnalyst #SIEMJunkie #ALLOPIONIONSAREMYOWN

%d bloggers like this: