Microsoft KB Archive/317741

= HOW TO: Mask IIS Version Information from Network Trace and Telnet =

Article ID: 317741

Article Last Modified on 3/29/2007

-

APPLIES TO


 * Microsoft Internet Information Services 5.0
 * Microsoft Internet Information Server 4.0

-



This article was previously published under Q317741



We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/prodtech/IIS.mspx



IN THIS TASK
SUMMARY View Information from Network Packet Capturing Software View Information from a Telnet Request Mask the Server Header Information
 * Install URLScan
 * Edit the Urlscan.ini File

REFERENCES



SUMMARY
This step-by-step article describes how to prevent the Internet Information Server (IIS) or Internet Information Services (IIS) version information that the server header contains from being displayed either in a network trace or from the results of a telnet command. To prevent this information from being displayed, you can implement URLScan, a free utility that is available at the Microsoft security Web site.

back to the top

View Information from Network Packet Capturing Software
When you run a network trace on a client, capture TCP packets, and then make a GET request to an IIS server from that same client, the following is displayed as a result of the information that is captured in the response from the IIS server:

In IIS 4.0:

HTTP: Server = Microsoft-IIS/4.0

In IIS 5.0:

HTTP: Server = Microsoft-IIS/5.0

To view this information:  Start a network trace from a client computer with a utility such as Network Monitor.NOTE: To set up your network tracing software, you must know the IP address of the Web server that you are making a request to. For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

252876 How to View HTTP Data Frames Using Network Monitor

 Use a Web browser to request a page from an IIS Web server. When the page that you requested is loaded in your browser, stop the capture, filter on HTTP protocol traffic, and review the results. The manufacturer of the operating system and the version of the software that the Web server is using are displayed in the first HTTP response frame from the IIS server. Look for the response frame from the server to the client that is using port .

back to the top

View Information from a Telnet Request
When you use a command prompt to telnet to the HTTP port of the IIS Web server, the banner includes the following information:

IIS 4.0:

server: Microsoft -IIS/4-0

IIS 5.0:

server: Microsoft -IIS/5.0

To perform a telnet request, type the following information at a command prompt:

telnet  80

Note the space between &quot;telnet&quot; and the IP address and the space between the IP address and &quot;80&quot;.

If no banner is displayed immediately, press the ENTER key two times.

back to the top

Mask the Server Header Information
To hide the server header information, download URLScan and then configure the Urlscan.ini file.

NOTE: The steps in this article only mask the server header information. This procedure does not prevent users from deducing from other information that is returned from Web pages that are served by an IIS Web server.

back to the top

Install URLScan
URLScan, which you can install with the IIS Lockdown Tool, is an ISAPI filter that provides the Web server administrator with additional configuration options to secure the server. One configurable option is the RemoveServerHeader option. By default, this option is set to 0, or False.

To download the URLScan utility, visit the following Microsoft Web site:

Urlscan Security Tool

http://www.microsoft.com/downloads/details.aspx?FamilyID=12244f33-a5da-4203-a3a8-83f4388bb71f&DisplayLang=en

By default, URLScan is installed in %systemroot%\System32\Inetsrv\UrlScan directory.

For additional information about how to install and configure URLScan, click the article number below to view the article in the Microsoft Knowledge Base:

307608 INFO: Availability of URLScan Version 2.5 Security Tool

To download the IIS Lockdown Tool, visit the following Microsoft Web site:

IIS Lockdown Tool

http://www.microsoft.com/technet/security/tools/locktool.mspx

back to the top

Edit the Urlscan.ini File
 Stop the IISAdmin service, which will also stop all of the services that are dependent on it, such as the World Wide Web Publishing Service. In My Computer, locate the Urlscan folder. By default, this is located at %systemroot%\System32\Inetsrv\Urlscan.</li> In Notepad or another text editor, open the Urlscan.ini file.</li>  Locate the following entry: RemoveServerHeader=0 </li>  Modify this entry as follows: RemoveServerHeader=1 </li> Save the file.</li> Restart the World Wide Web Publishing service and all of the other services that were stopped when the IISAdmin service was stopped. Starting a service that runs under the IISAdmin service also starts the IISAdmin service.</li></ol>

back to the top

<div class="references_section">