获取网站Web服务器类型的办法如下:
有些同学老问怎么判断Web服务器,问这个扫描器那个扫描器顿时月经来潮。如nmap nc nikto等好多可以的….要那么多扫描器干嘛 NMAP一个就够了!方法N多,举几个例子吧!
- nmap
-
- pentest@yinyin:~$ nmap -sV -p 80 www.xxoo.com
-
- Starting Nmap 5.00 ( http://nmap.org ) at 2010-05-24 19:49 CST
- Interesting ports on 203.xxx.xxx.1×1:
- PORT STATE SERVICE VERSION
- 80/tcp open http nginx web server 0.8.16
-
- Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
- Nmap done: 1 IP address (1 host up) scanned in 6.97 seconds
- ———————————————————————————————————-
-
- nc
-
- pentest@yinyin:~$ nc -vv www.xxoo.com 80
- Connection to www.xxoo.info 80 port [tcp/www] succeeded!
- get http /1.1
- HTTP/1.1 400 Bad Request
- Date: Mon, 24 May 2010 11:54:35 GMT
- Server: Apache
- Connection: close
- Content-Type: text/html; charset=iso-8859-1……..省略
- ———————————————————————————————————-
-
- Curl
lCurl是一款用于在网络上传输数据的工具,支持HTTP, HTTPS, FTP, FTPS, TFTP, DICT,TELNET,LDAP等协议。通过curl你既可以将服务器的数据下载下来,也可以将本地的数据上传到服务器。curl的选项很多,大家可以 参考curl 官方说明!
- pentest@yinyin:~$ curl –head http://www.artist-tc.com/
- HTTP/1.1 200 OK
- Server: nginx/0.8.16
- Date: Mon, 24 May 2010 12:00:55 GMT
- Content-Type: text/html
- Connection: keep-alive
- Keep-Alive: timeout=20
- Vary: Accept-Encoding
- ———————————————————————————————————-
提供个可批量扫描的批处理!胡乱写的 将就下吧!
- echo FOR /F ^%%a IN (1.txt) DO nmap -sV -PN -p 80 ^%%a -r > scan.bat
- cmd.exe < scan.bat
- del /q /f scan.bat
- pause
把需要扫描的网址 IP IP段写进1.txt就可以了!需要安装nmap 不保存以及过滤结果 自行修改吧!
在来个curl扫描脚本!首先创建一个site.txt文件,里面输入相应的网站。
- pentest@ubuntu:~$ head site.txt
- g.cn
- baidu.com
- qq.com
- www.xxoo.com
之后结合下面的curl.sh脚本,就可以获知site.txt中网站的服务器类型了。
- #!/bin/sh
- IIS=0
- nginx=0
- apache=0
- other=0
- if [ ! -f site.txt ]; then
- echo “ERROR:site.txt NOT exists!”
- exit 1
- fi
-
- total=`wc -l site.txt|awk ‘{print $1}’`
- for website in `cat site.txt`
- do
- server=`curl -Is –connect-timeout 15 $website|awk -F”:” ‘/^Server:/{print $2}’`
- echo -e $website”:” $server
- if echo $server|grep -i “IIS”>/dev/null
- then IIS=`expr $IIS + 1`
- elif echo $server|grep -i “Apache”>/dev/null
- then Apache=`expr $Apache + 1`
- elif echo $server|grep -i “nginx”>/dev/null
- then nginx=`expr $nginx + 1`
- else other=`expr $other + 1`
- fi
- done
- echo “——————————————–”
- echo -e “Total\tApache\tIIS\tnginx\tother”
- echo -e “$total\t$Apache\t$IIS\t$nginx\t$other”
- echo -e “100%\t”`echo “scale=5;$Apache/$total*100″|bc|cut -c1-5`”%\t”`echo “scale=5;$IIS/$total*100″|bc|cut -c1-5`”%\t”`echo “scale=5;$nginx/$total*100″|bc|cut -c1-5`”%\t”`echo “scale=5;$other/$total*100″|bc|cut -c1-5`”%\t”
- echo “——————————————–”
- exit 0
输出结果:
- pentest@ubuntu:~$ ./curl.sh
- -e g.cn: gws
- -e baidu.com: Apache
- -e qq.com: nginx/0.6.39
- -e www.artist-tc.com: nginx/0.8.16
-
-
- ——————————————–
- -e Total Apache IIS nginx other
- -e 4 1 0 2 1
- -e 100% 25.00% 0% 50.00% 25.00%
- ——————————————–