Embedded Files
Remove Version Number from Error Pages
Assumes a JDK is in your PATHNote that making this change may prevent Lambda/Psi Probe (popular Tomcat monitoring webapp) to initialise as it cannot determine the Tomcat version.Remove Version Number from Error Pages
cd /tomcat/latest/lib
jar xf catalina.jar org/apache/catalina/util/ServerInfo.properties
vi org/apache/catalina/util/ServerInfo.properties # (server.info=Apache Tomcat)
jar uf catalina.jar org/apache/catalina/util/ServerInfo.properties
rm -r org
Restart Apache Tomcat...
systemctl restart tomcat
Remove HTTP Access to Release Notes
Remove HTTP Access to Release Notes
By default, this URL will work from any browser on the network (firewall rules permitting)...
http://mytomcatserver:8080/RELEASE-NOTES.txt
This document will generally reveal the version number of Tomcat.
To address this, simply remove the RELEASE-NOTES.txt file from production Tomcat servers...
rm /tomcat/latest/webapps/ROOT/RELEASE-NOTES.txt
Replace favicon.ico
Replace favicon.ico
Default favicon.ico files can be flagged during penetration test because they identify the software in use. To avoid this situation follow the notes below.
Identify a suitable replacement favicon.ico. Either use one of the many online favicon.ico designer tools or find a nondescript one from another server.
To replace the Tomcat favicon.ico:
cd /tomcat/latest/webapps/ROOT
cp favicon.ico favicon.icoO # Backup existing favicon
Replace favicon.ico with your alternate icon.
Page updated
Google Sites
Report abuse