Re: reverse proxy identification

[Javier Fernández-Sanguino <jfernandez () germinus com>]

sami ghourabi dijo:
> However I dont think that for each IP adress there is a physical server, 
> but perhaps a multiplexing device that also does application firewalling.
> According to nmap it may be a Blue Coat SG4.

If it's a Bluecoat (or some other reverse proxy) which is load balancing 
between different servers you can sometimes determine the techonology 
based on the cookie used for tracking users at the app level (although 
not everybody does this, some people configure reverse proxies to do 
persistence by IP address or, even, no persistence).

You can use the cookie database available at: 
http://www.owasp.org/index.php/Category:OWASP_Cookies_Database

Regards

Javier





------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.

http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------