在http请求头中隐藏Apache或者nginx的真实Server信息

阅读更多

隐藏Apache的方法:
更改Apache的源码，然后重新编译安装，需要改动的源代码信息如下：
include目录下-->ap_release.h文件

#define AP_SERVER_BASEVENDOR "Apache Software Foundation"
#define AP_SERVER_BASEPROJECT "Apache HTTP Server"
#define AP_SERVER_BASEPRODUCT "Apache"

#define AP_SERVER_MAJORVERSION_NUMBER 2
#define AP_SERVER_MINORVERSION_NUMBER 4
#define AP_SERVER_PATCHLEVEL_NUMBER   25
#define AP_SERVER_DEVBUILD_BOOLEAN    0

隐藏Nginx的方法:
更改Nginx的源码，然后重新编译安装，需要改动的源代码信息如下：
src/http目录下-->ngx_http_header_filter_module.c文件

static u_char ngx_http_server_string[] = "Server: nginx" CRLF;
static u_char ngx_http_server_full_string[] = "Server: " NGINX_VER CRLF;
static u_char ngx_http_server_build_string[] = "Server: " NGINX_VER_BUILD CRLF;

src/core目录下-->nginx.h文件

/*
 * Copyright (C) Igor Sysoev
 * Copyright (C) Nginx, Inc.
 */


#ifndef _NGINX_H_INCLUDED_
#define _NGINX_H_INCLUDED_


#define nginx_version      1013003
#define NGINX_VERSION      "1.13.3"
#define NGINX_VER          "nginx/" NGINX_VERSION

#ifdef NGX_BUILD
#define NGINX_VER_BUILD    NGINX_VER " (" NGX_BUILD ")"
#else
#define NGINX_VER_BUILD    NGINX_VER
#endif

#define NGINX_VAR          "NGINX"
#define NGX_OLDPID_EXT     ".oldbin"


#endif /* _NGINX_H_INCLUDED_ */

这个nginx的版本号也可以不用改源代码来实现隐藏，在配置文件nginx.conf中http类别里加入server_tokens off;就可以隐藏版本号了，修改后需要重新启动才能生效。