Which web server fingerprinting tool identifies servers based on HTTP characteristics even when the banner is obfuscated?

Which web server fingerprinting tool identifies servers based on HTTP characteristics even when the banner is obfuscated?

• A. WhatWeb
• B. httprint
• C. Intercepting Traffic from Browser Extensions
• D. GNU Wget

Answer: (B)

HTTP fingerprinting relies on the way a web server responds to requests, not just what it prints in a banner. The tool in question is designed to compare the actual HTTP response pattern—header fields, their order, default pages, and other response quirks—against a database of known signatures. This lets it identify the server software and version even if the Server banner is hidden or obfuscated, because the fingerprint comes from how the server behaves, not from a visible label. WhatWeb can also use HTTP data, but it’s a broader fingerprinting framework that relies on multiple signals to identify technologies, not specifically optimized for the banner-omitted, behavior-based HTTP fingerprinting scenario described. The other option isn’t a fingerprinting tool at all, and GNU Wget is a downloader, not a server-identity tool.

HTTP fingerprinting relies on the way a web server responds to requests, not just what it prints in a banner. The tool in question is designed to compare the actual HTTP response pattern—header fields, their order, default pages, and other response quirks—against a database of known signatures. This lets it identify the server software and version even if the Server banner is hidden or obfuscated, because the fingerprint comes from how the server behaves, not from a visible label.

WhatWeb can also use HTTP data, but it’s a broader fingerprinting framework that relies on multiple signals to identify technologies, not specifically optimized for the banner-omitted, behavior-based HTTP fingerprinting scenario described. The other option isn’t a fingerprinting tool at all, and GNU Wget is a downloader, not a server-identity tool.