nerdexam
GIAC

GSLC · Question #263

Which of the following tools hides information about IIS Webservers so that they can be prevented from various attacks performed by an attacker?

The correct answer is C. ServerMask. ServerMask is a security tool specifically designed to obfuscate IIS web server identity information in HTTP response headers, reducing the attack surface against fingerprinting-based attacks.

Security Architecture & Engineering

Question

Which of the following tools hides information about IIS Webservers so that they can be prevented from various attacks performed by an attacker?

Options

  • AWinSSLMiM
  • Bhttprint
  • CServerMask
  • DWhisker

How the community answered

(41 responses)
  • A
    2% (1)
  • B
    2% (1)
  • C
    95% (39)

Why each option

ServerMask is a security tool specifically designed to obfuscate IIS web server identity information in HTTP response headers, reducing the attack surface against fingerprinting-based attacks.

AWinSSLMiM

WinSSLMiM is an SSL man-in-the-middle interception tool used to capture encrypted traffic - it does not hide or alter web server identity headers.

Bhttprint

httprint is used to fingerprint and identify web server information, which is the opposite function of hiding server identity.

CServerMaskCorrect

ServerMask works by stripping or replacing the HTTP Server response header and other IIS-specific headers that reveal the web server type and version to potential attackers. By preventing fingerprinting tools from accurately identifying the server platform, ServerMask removes the attacker's ability to look up known vulnerabilities specific to that IIS version. This security-through-obscurity layer is a recognized IIS hardening technique used alongside patching and access controls.

DWhisker

Whisker is a CGI scanner that searches for vulnerable scripts on web servers and does not provide any capability for masking server identity.

Concept tested: IIS web server identity obfuscation and header hardening

Source: https://www.port80software.com/products/servermask

Topics

#IIS hardening#web server obfuscation#ServerMask#attack prevention

Community Discussion

No community discussion yet for this question.

Full GSLC Practice