Page 37

How to use HTTPrint

Posted on March 30th, 2011 by Victoria Pal in Tech

HttPrint is a web server fingerprinting tool by Net Square. It reveals all the details about a web server, and it makes a pretty decent conclusion about what the webserver used. Identification is based on the implementation differences in the HTTP protocol.



Custom Error Pages

Posted on March 22nd, 2011 by Victoria Pal in Tech

Custom 404 error pageAs you most probably know, each year we have several seasonal report periods during which we monitor the leaders in the retailing industry to see if their online performance matches their reputation. This year is no different and last month we published the results for this Valentine’s day online retailer monitoring.

One of the interesting cases that caught our attention is the site of Victoria's Secret. While at first glance their uptime does not strike the user with a 100% uptime percentage, the downtime recorded for their transaction happened regularly (every 2 days), always around 5 am and lasted usually for about 15 minutes. Since 5 a.m. is clearly not the busiest shopping time of the day, it was most likely a regular, scheduled site maintenance. However, this was not indicated either in their error message or elsewhere on their site. Instead, next to the picture of the stunningly beautiful Alessandra Ambrosio stood the awkward downtime excuse "We're sorry, our site is temporarily unavailable." .


Server Masking - First Line of Defense

Posted on March 15th, 2011 by Victoria Pal in Tech
Protect your serverThere are various ways to protect a web server. Web servers often become victims of DDoS attacks and it is not uncommon for exploits to be used to gain access or break a web server. Protection comes in different forms and levels, the costs vary, but sometimes there are simple solutions. This one you can implement today. You can mask your server. When looked up, the server can say anything. I mean it, anything. It is probably a good practice to not make up something like “WSP Unbreakable Server 1.3.5”, but to instead choose one from the existing web server platforms.

There are two ways to go about this. You can make your server identify as a completely different server or just to say it is an older version of the server you run. When you choose to make your Lighttpd server identify as Apache, you take a great portion of amateur attacks and direct them in a completely wrong direction. On the other hand, if you decide to simply identify as an older version, 3rd parties who try anything funny will probably try to exploit your server with outdated tactics. It can still be useful. What actually works best is to change the name and version of the server. This should take care of at least some malevolent eyes.

Server mask
Many sites use this. Torrent trackers are one good example. Most of these sites do not use Apache as trackers usually go for Lighttpd or Nginx. From the example above you can see that the web server powering the site is Apache 1.3.29. This is actually quite old now. The latest stable release is Apache 2.2.17.

There is actually a bit more to it than just masking your server’s name. If you are running a Windows server (secure enough, but it can use some tweaks), there is a commercial software solution. It takes care of more than just server name change. It’s called ServerMask. Like with most commercial software there is a free trial for you to try. A great solution for Apache is Mod_Security.


What Is The 100% Network Uptime Guarantee?

Posted on March 1st, 2011 by Victoria Pal in Tech

100% uptimeAgain and again we see companies offering 100% uptime. In a previous post I have ranted about how inaccurate uptime is perceived. Here I would like to have another go at the never-failing servers and indestructible network infrastructures.

100% Network Uptime Guarantee – It sounds tempting and nice. Actually, a lot of hosting providers are advertising this on their sites. When you read “100% uptime”, you instantly get the idea that they found some miraculous way to keep the network availability and servers running with no interruption. The other way to think about it is to consider it a scam.


Reduce Your Power Consumption

Posted on February 24th, 2011 by Victoria Pal in Tech


Go green
How can you run a server and still feel good about your energy bill and the environment? That is a hard one, because no matter whether you are running a server for business purposes, or a personal project, the power company bill arrives at the same time every month. Here are a couple of things anyone can do to improve the situation. These are applicable to both home users and people running one or more servers.

Modest hardware updates


Find out if you can do reasonably-priced upgrades. If you are able to buy a CPU, which uses less power, but provides the same performance – do so. New CPUs pop up all the time. One good preemptive action against fast changing technologies is to purchase a good board. Spend more on it and it will pay off with better CPU support. One example is the Phenom II x4. Mid-range priced AM3 motherboards supported all x4 processors. Currently the same motherboards support x6 CPUs. You might spend a bit more on the x6 CPU, but second hand prices for x4 are still very good, so here are another 2 core out of nothing.