Web Server Software Version Fingerprinting

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•10

This rule detects attempts to fingerprint web server software versions by looking for common server headers in HTTP responses. Specifically, it triggers if a client receives an HTTP response containing 'Apache/', 'nginx/', 'IIS/', or 'PHP/' followed by a digit, indicating a version number. The rule is thresholded to trigger only after 10 such events from the same destination within 30 seconds, aiming to reduce alerts from legitimate browsing.