Remove IIS server version worked for HTTP, but not HTTPS!

WindowsGeek 21

Hello,
I used the HTTP Response headers and changed IIS to the Apache, but Nmap tool could detect IIS on port 443. How can I change it on port 443 too?

Thank you.

Lex Li 6,037 Reputation points

2021-09-14T14:24:57.23+00:00

Each web servers has tons of unique behaviors so that they can be detected even if you change the Server response header. You cannot fool a patient hacker (Nmap is just one of the tools for hackers).
MotoX80 37,151 Reputation points

2021-09-14T14:39:56.94+00:00

I used the HTTP Response headers and changed IIS to the Apache

What does that mean? Did you configure an IIS web site to return a header to make it look like you are running Apache instead of IIS? Or did you update the bindings in IIS to stop it from listening on port 80, and launched Apache with a site on port 80?

What specifically did you change?

If you updated the response headers, you have to do that for each web site in IIS.
WindowsGeek 21 Reputation points

2021-09-26T07:19:07.69+00:00

Hello,
Thank you so much for your reply.
I configured an IIS web site to return a header to make it look like I'm running Apache instead of IIS:

Can you share some of your experiences about fool the hackers? Can I install an Apache web server and use IIS to redirect all HTTP requests to the Apache web server?

Thank you.

6 answers

rico 1 Reputation point

2022-12-08T17:56:55.96+00:00

My understanding of the specifics might be wrong but in essence, all routing gets handle by the HTTP Application class. In my case we used Global.asax, a class derived from HttpApplication. This is what handles GLOBAL raised events and calls.

In my code, manipulating web.config or IIS Manager did not resolve issue. In the last leg of the journey from server to client, server was being added (thus overriding removal of it in web.config or IIS Manager). I had to target this last step in Global.asax such as:
protected void Applicatoin_PreSendRequestHeaders()
{
Response.Headers.Remove("Server")
// can add field for server as such; optional
Response.AddHeader("Server", "nah nah nah nah nahh")
}

https://stackoverflow.com/questions/22401219/remove-server-response-header-iis-8-0-8-5
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Remove IIS server version worked for HTTP, but not HTTPS!

6 answers

Your answer