Technical Forum
Ask questions. Discover Answers.
cancel
Showing results for 
Search instead for 
Did you mean: 

How to hide BIG-IP from Shodan.io?

Abdulmajeed
Nimbostratus
Nimbostratus

Hi

We have website when I check our website in Shodan.io it shows that we are using BIG-IP.. How can we hide this information?

1 REPLY 1

Simon_Blakely
F5 Employee
F5 Employee

You need to figure out how Shodan.io has determined that you are using a BigIP for your virtual server.

 

It may be that an irule (for redirection, maybe) responds with a Server header (BigIP) - you can disable this with the -noserver flag.

 

If the website is HTTPS, it may use TLS fingerprinting (if you use DEFAULT as the cipher string).

 

They may just use TCP OS fingerprinting, which is fairly marginal.

 

I don't really know - I'm not too familiar with Shodan.

 

However, just knowing that a service is accessed via a BigIP does not say particularly much about it (apart from attacking irules). It might be better than Shodan determining and revealing that the site is running on an older version of IIS or something else that may provide more useful information to an attacker ...

 

Edit:

 

As far as I can see, Shodan picks up on the Server: BigIP header used when an irule generates a response to the client. You can disable this with the -noserver option mentioned earlier.