Printable View
Does any1 know now can I make my microsoft IIS 5 box look like a different web box, is there a way to change the banner, at the moment im runing a default setup of IIS 5 running on a win2k pro box. I want to lock it down before i put it out in the wild. + has any 1 got ne tips on logs and seting up honeypots. im thinking is Snort a good IDS to put on it.
Thanks guy's
Ru$kb0y :confused:
Quote:
Originally posted here by Ru$kb0y
Does any1 know now can I make my microsoft IIS 5 box look like a different web box, is there a way to change the banner, at the moment im runing a default setup of IIS 5 running on a win2k pro box. I want to lock it down before i put it out in the wild. + has any 1 got ne tips on logs and seting up honeypots. im thinking is Snort a good IDS to put on it.
Thanks guy's
Ru$kb0y :confused:
Why are you trying to mask the fact that the web server is running IIS? If you want to run something else, why not just install another web server? If it's an issue of OS, then just install some flavor of Linux and run your server using Linux apps..
Snort is a great IDS to run on your box...
Its not a case of using a new operation system, i wana Disguise the operation system i am running.
have you thought of using apache? it's just as efficient if not more than iis, not as exploitable, and not an M$ product...
Ok guys its not bout which OS or Web Server im running its just im wondering if ne1 knows how to, make my current web server look like a different1 on the web so that if a hacker is trying to gain info on my box they will be fooled into thinking its not a iis box.
May be im just a little crazy...
Ru$kb0y
Microsoft provides a lockdown tool that contains, among other things, urlscan. You can also get urlscan by itself (check google, it get you there pretty quickly). URLscan does a lot of good things for an IIS 5, including letting you specify the header. I haven't tried it with the ISS 5 Jr. that comes with W2k Pro.
Or you could try hand editing the C:\winnt\system32\inetsrv\w3svc.dll. But good luck with that.
Haha, you could copy one of those 'Made with Macintosh' banners that you can get off the macintosh site. Or you could have the NetBIOS name of the computer be: UNIX BOX. Hahaha, I crack myself up.
At the very least it'd be confusing...
URLscan from Microsoft will hide the banner. This does not prevent the web server from being identified (as an article I will publish soon will show)
Port80 software produces something called ServerMask which does a lot better - but it still leaves some traces. It is, however, commercial software. I do believe, though, that it's a lot cheaper than a Win2k Server licence, so it will only add a little to your software bill.