[研究]用 curl -I 檢測Web Server軟體種類、版本
2025-05-16
用 curl -I
Microsoft網站看不出來
C:\>curl -I https://microsoft.com/ HTTP/1.1 301 Moved Permanently Date: Thu, 15 May 2025 06:50:21 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Location: https://www.microsoft.com/ x-azure-ref: 20250515T065021Z-17fc6f5689742cs8hC1TPErcmn0000000kfg0000000084u3 Strict-Transport-Security: max-age=31536000 X-Cache: CONFIG_NOCACHE C:\> |
C:\>curl -I https://www.ptt.cc
HTTP/1.1 302 Found
Date: Thu, 15 May 2025 06:46:58 GMT
Content-Type: text/html
Connection: keep-alive
Server: cloudflare
Cf-Ray: 9400ae65088ed7a7-LAX
Location: https://www.ptt.cc/index.html
Cache-Control: max-age=3600s, public
Cf-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pQ1LblRBjo7G1SfLciahmWF5u23o5LIlszgMtGjCKurwZp6d2luPoKEpPgF9A2RhOQ7Ns8CaRiZDsBX%2B14AZGaEVz0qal9fEFGk67ZtcaBOxHpWH%2F46OUZUK5ieo"}],"group":"cf-nel","max_age":604800}
Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Strict-Transport-Security: max-age=0
X-Content-Type-Options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=134799&min_rtt=133794&rtt_var=39477&sent=6&recv=6&lost=0&retrans=0&sent_bytes=3281&recv_bytes=380&delivery_rate=32111&cwnd=254&unsent_bytes=0&cid=cd4b51c297d2f7cd&ts=456&x=0"
|
C:\>curl -I https://24h.pchome.com.tw/
HTTP/1.1 302 Found
server: nginx
date: Thu, 15 May 2025 06:40:01 GMT
content-type: text/html
location: https://24h.pchome.com.tw/
via: 1.1 google
X-CDN-CACHE-STATUS: miss
Transfer-Encoding: chunked
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
C:\>curl -I https://www.hinet.net
HTTP/1.1 403 Forbidden
Server: HiNetCDN
Date: Thu, 15 May 2025 06:39:00 GMT
Content-Type: text/plain
Connection: keep-alive
content-length: 10
x-request-id: e490573edebb5ee2a4ac3ff809923a32
X-Cache: RULE
|
C:\>curl -I https://www.google.com
HTTP/1.1 200 OK
Content-Type: text/html; charset=ISO-8859-1
Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-h0oGCAOVIurhZ5lnJHu-lA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
Accept-CH: Sec-CH-Prefers-Color-Scheme
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Date: Thu, 15 May 2025 06:39:16 GMT
Server: gws
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Expires: Thu, 15 May 2025 06:39:16 GMT
Cache-Control: private
Set-Cookie: AEC=AVcja2fe4mJ4q33gWnl4k1C1wEnbnrOK-TKTtYfdbYdG_3K2To0WhSTFUQ; expires=Tue, 11-Nov-2025 06:39:16 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
Set-Cookie: NID=524=s7jqh_ngnnMVZX_kt5hwWH05I3MDy-k0jtX7yZloBN8aCGYrDR2qSjYWzcWYXujTfDQv3VG6re5gbrg65BiTqM0GKXwUyj7aLpsw2k8Is4_tSCdi5_oIWbAd4c9SqL6N5xgS9ulhbirkmRlZZ_X2nbMpdV3evrtuv5fXV7ajWAl0eD_T21_zrgP4rB42WJF6pFcxC0pr-Dt4mVs; expires=Fri, 14-Nov-2025 06:39:16 GMT; path=/; domain=.google.com; HttpOnly
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
C:\>curl -I https://www.nycu.edu.tw/
HTTP/1.1 303 303
Date: Thu, 15 May 2025 06:56:04 GMT
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Security-Policy: default-src 'self';script-src 'unsafe-eval';frame-ancestors 'self' *.instagram.com maps.googleapis.com fonts.googleapis.com *.youtube.com; connect-src 'self' 'unsafe-inline' https://directline.botframework.com wss://directline.botframework.com https://analytics.google.com https://graph.facebook.com;base-uri 'self';font-src 'self' *.nycu.edu.tw;form-action 'self' *.google.com;style-src 'self' 'unsafe-inline' 'unsafe-eval' ;object-src 'none';img-src data: 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.nycu.edu.tw *.googletagmanager.com *.google-analytics.com *.analytics.google.com *.g.doubleclick.net *.google.com *.google.com.tw *.youtube.com *.googleapis.com *.gstatic.com maps.googleapis.com fonts.googleapis.com i3.ytimg.com www.googletagmanager.com *.facebook.com i.ytimg.com *.instagram.com *.cdn.botframework.com *.directline.botframework.com https://scontent-tpe1-1.xx.fbcdn.net;script-src-elem 'self' 'unsafe-inline' *.googletagmanager.com *.google.com *.instagram.com *.googleapis.com *.gstatic.com maps.googleapis.com https://cdn.botframework.com/botframework-webchat/latest/webchat.js *.youtube.com;frame-src 'self' *.instagram.com maps.googleapis.com fonts.googleapis.com *.youtube.com *.google.com *.facebook.com;
Location: /nycu/ch/index
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Frame-Options: DENY
Content-Language: en-US
Set-Cookie: XSRF-TOKEN=29479531-aff0-4089-b94c-ab20655cd48e; Path=/; Secure;HttpOnly;Secure;SameSite=Strict
Set-Cookie: JSESSIONID=6AABD26AA3303D7AC04FC1E23160D3AC; Path=/; Secure; HttpOnly;HttpOnly;Secure;SameSite=Strict
Strict-Transport-Security: max-age=157680000
Set-Cookie: nctu_id=AAY7BJAlaDtXRhgBAAAAADtfdnfRh3D7QhfQO_wrFypb-T9eegEBZmpshTivkU8DOw==iJMlaA==P7LgW55FTCsa74gNJWJ92bxIbxE=; Domain=.nycu.edu.tw; Path=/; Secure; HttpOnly
|
自行用 Windows Server 2025 Standard 架設的 IIS 測試
C:\>curl -I http://localhost
HTTP/1.1 200 OK
Content-Length: 703
Content-Type: text/html
Last-Modified: Thu, 15 May 2025 07:13:41 GMT
Accept-Ranges: bytes
ETag: "7e5d18e368c5db1:0"
Server: Microsoft-IIS/10.0
Date: Thu, 15 May 2025 07:16:46 GMT
C:\>
|
用 Windows Server 2019 Standard 的 IIS 架設的，可能因為在資安設備後面，看不出 IIS 了
C:\>curl -I https://(略)/ HTTP/1.1 200 OK Cache-Control: private Content-Length: 15361 Content-Type: text/html; charset=utf-8 X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer-when-downgrade Strict-Transport-Security: max-age=31536000 Date: Thu, 15 May 2025 07:18:44 GMT C:\> |
也可以用類似 nmap -sV -p 80,443 192.168.1.100 檢測，但慢。
(完)
相關
沒有留言:
張貼留言