Results 1 to 9 of 9

Thread: Not IIS 5???

  1. #1

    Not IIS 5???

    Does any1 know now can I make my microsoft IIS 5 box look like a different web box, is there a way to change the banner, at the moment im runing a default setup of IIS 5 running on a win2k pro box. I want to lock it down before i put it out in the wild. + has any 1 got ne tips on logs and seting up honeypots. im thinking is Snort a good IDS to put on it.

    Thanks guy's

    Ru$kb0y

  2. #2

    Re: Not IIS 5???

    Originally posted here by Ru$kb0y
    Does any1 know now can I make my microsoft IIS 5 box look like a different web box, is there a way to change the banner, at the moment im runing a default setup of IIS 5 running on a win2k pro box. I want to lock it down before i put it out in the wild. + has any 1 got ne tips on logs and seting up honeypots. im thinking is Snort a good IDS to put on it.

    Thanks guy's

    Ru$kb0y

    Why are you trying to mask the fact that the web server is running IIS? If you want to run something else, why not just install another web server? If it's an issue of OS, then just install some flavor of Linux and run your server using Linux apps..

    Snort is a great IDS to run on your box...

  3. #3
    Its not a case of using a new operation system, i wana Disguise the operation system i am running.

  4. #4
    Senior Member
    Join Date
    Sep 2001
    Posts
    144
    have you thought of using apache? it's just as efficient if not more than iis, not as exploitable, and not an M$ product...

  5. #5
    Ok guys its not bout which OS or Web Server im running its just im wondering if ne1 knows how to, make my current web server look like a different1 on the web so that if a hacker is trying to gain info on my box they will be fooled into thinking its not a iis box.

    May be im just a little crazy...


    Ru$kb0y

  6. #6
    Microsoft provides a lockdown tool that contains, among other things, urlscan. You can also get urlscan by itself (check google, it get you there pretty quickly). URLscan does a lot of good things for an IIS 5, including letting you specify the header. I haven't tried it with the ISS 5 Jr. that comes with W2k Pro.

  7. #7
    Junior Member
    Join Date
    Aug 2001
    Posts
    2
    Or you could try hand editing the C:\winnt\system32\inetsrv\w3svc.dll. But good luck with that.

  8. #8
    Junior Member
    Join Date
    Mar 2003
    Posts
    3
    Haha, you could copy one of those 'Made with Macintosh' banners that you can get off the macintosh site. Or you could have the NetBIOS name of the computer be: UNIX BOX. Hahaha, I crack myself up.

    At the very least it'd be confusing...
    I hurt myself today/To see if I still feel/I focus on the pain/The only thing that\'s real

    http://www.AntiOnline.com/sig.php?imageid=315

  9. #9
    Senior Member
    Join Date
    Jan 2002
    Posts
    1,207
    URLscan from Microsoft will hide the banner. This does not prevent the web server from being identified (as an article I will publish soon will show)

    Port80 software produces something called ServerMask which does a lot better - but it still leaves some traces. It is, however, commercial software. I do believe, though, that it's a lot cheaper than a Win2k Server licence, so it will only add a little to your software bill.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •