Forum Discussion
How to hide BIG-IP from Shodan.io?
Hi
We have website when I check our website in Shodan.io it shows that we are using BIG-IP.. How can we hide this information?
- Simon_BlakelyEmployee
You need to figure out how Shodan.io has determined that you are using a BigIP for your virtual server.
It may be that an irule (for redirection, maybe) responds with a Server header (BigIP) - you can disable this with the -noserver flag.
If the website is HTTPS, it may use TLS fingerprinting (if you use DEFAULT as the cipher string).
They may just use TCP OS fingerprinting, which is fairly marginal.
I don't really know - I'm not too familiar with Shodan.
However, just knowing that a service is accessed via a BigIP does not say particularly much about it (apart from attacking irules). It might be better than Shodan determining and revealing that the site is running on an older version of IIS or something else that may provide more useful information to an attacker ...
Edit:
As far as I can see, Shodan picks up on the Server: BigIP header used when an irule generates a response to the client. You can disable this with the -noserver option mentioned earlier.
- aali86Altostratus
Hi Simon, I am also encountering the same issue but when i do curl from BIGIP it is showing same result but server name changed as defined can you please share where should i mention -noserver option
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com