- 隐藏web名称及版本号
1）信息泄露：
-
- 报错时显示信息；
- curl显示信息；
[[email protected] ~]# curl -I http://www.etiantian.org/sd HTTP/1.1 404 NOT FOUND Server: nginx/1.2.9 #未隐藏版本号 Date: Wed, 21 Oct 2015 15:57:08 GMT Content-Type: text/html Connection: keep-alive Vary: Accept-Encoding
2）解决方法：
[[email protected] nginx-1.6.2]# sed -n ‘13,17p‘ src/core/nginx.h
#define NGINX_VERSION "2.4.2" #define NGINX_VER "nginx/" NGINX_VERSION #define NGINX_VAR "OLDBOY_SERVER" #define NGX_OLDPID_EXT ".oldbin"
|
[[email protected] application]# find / -type f -name "ngx_http_special_response.c" /server/tools/nginx-1.6.3/src/http/ngx_http_special_response.c |
[[email protected] nginx-1.6.2]# sed -n 49p src/http/ngx_http_header_filter_module.c
static char ngx_http_server_string[] = "Server: OLDBOY_SERVER" CRLF;
[[email protected] nginx-1.6.2]# sed -n ‘21,29p‘ src/http/ngx_http_special_response.c
static u_char ngx_http_error_full_tail[] = "<hr><center>" NGINX_VER(http://oldboy.blog.51cto.com) "</center>" CRLF "</body>" CRLF "</html>" CRLF ;
static u_char ngx_http_error_tail[] ="<hr><center>OlDBOY_SERVER</center>" CRLF "<hr><center>" NGINX_VER " (http://oldboy.blog.51cto.com)</center>" CRLF#<==此行是定义对外展示的内容
时间： 2024-12-14 23:53:19