Menu

ℹ️ What is JBoss? What is JBoss Domain Management ? 🛠️ Install JBOSS-EAP 6.4 📜 Start & Stop JBOSS script. 🚀 Application Deployment Methods - 1. 🚀 Application Deployment Methods - 2. 🚀 Application Deployment Methods - 3. ⚙️ Multiple Instance of JBoss EAP. 🔐 SSL on JBOSS EAP. 🧰 WINDOWS service for JBOSS EAP. 🛠️ JBoss EAP 7 - DOMAIN Installation. 🚀 DOMAIN DEPLOYMENT - GUI MODE. 🔐 SSL on JBOSS 7.1 Admin console & Application. 🌐 Apache mod_jk HTTP Connector - JBOSS AS 7.1 🌐 Apache Configure mod_proxy as load balancer (LB)- JBoss 7.1 🧯 Issue SocketTimeoutException 🧰 JBoss-Remote JMX Connection (jvisualvm) 🌐 Apache Mod Cluster as load balancer (LB) - JBoss 6.4 🧯 Out of space in CodeCache 🧯 java.sql.SQLRecoverableException: Closed Connection 🧯 sun.security.provider.certpath.SunCertPathBuilderException 📈 JBOSS EAP 6 TO 7 Migration 🔐 Host Header injection on JBOSS EAP 7.2 🔐 Encrypting Datasource Passwords using Vault in JBOSS
ℹ️ Some useful links of IBM. 🛠️ WAS Installation using command line. 🛠️ Installing Suppliments (IHS/Plugins/WCT) command line. 🛠️ Uninstalling Suppliments (IHS/Plugins/WCT) command line. 📈 Installing fix-pack using command line. ℹ️ Profiles in WebSphere® Application Server ND. 📜 WebSphere Profiles list & Basics Commands 🛠️ Commands for Custom / Application server / Dmgr Profiles 🛠️ Creating WAS-ND Cluster using GUI MODE. 🚀 Application Deployment on WAS-ND - Cluster Env. 📜 Analyze - JVM logs. 🧰 What is MustGather script ? 🧯 PsList to troubleshoot high CPU usage in Windows 🛠️ WebSphere App Server - Updating ports in existing profiles 🛠️ Installation Manager (IM) on non-default location 🛠️ Websphere Base or ND Installation using Command 📈 Install or Update FIXPACK on WebSphere 8.5.+ 🛠️ Install SDK 8.0 on Websphere 8.5.5.9+ using Command method. 🛠️ How to Create a Clone of any profiles on WAS. 🛠️ Installation Manager (IM) on non-Administrator user. 🛠️ WebSphere Application Server 7.0.0.X & FIXPACK install / Update on the non-default location. 📈 WebSphere ND Migration 7.0 to 8.0 / 9.0 🛠️ IBM WebSphere 9.0.0.0 and IHS (IBM HTTP SERVR) Installation with Fixapck using Command Line (non-root) user
🛠️ Configure IHS (IBM HTTP Server) with WAS 8.5.X.X. 🛠️ Multiple IHS in front of WAS (On Single Install). 📊 Monitor IBM HTTP Server connections. 🔐 Self-signed Cert using ikeyman tool. 🔐 Self-Signed Cert using command line. 🔐 Decrypt Stash File.
🌐 Apache HTTP Server ℹ️ HTTP STATUS CODES 📜 Apache Rewrite Rules 🛠️ How to configure Apache MPM. 🛠️ Install Apache HTTP Server 2.4.27 ver. on LINUX 🛠️ Apache Tomcat - 9.0.0.M21 Installation on WIN 🌐 Apache mod_jk HTTP Connector - JBOSS AS 7.1 🌐 Apache Configure mod_proxy as load balancer (LB)- JBoss 7.1 🧯 Apache error : Server ran out of threads to serve requests (Windows) 🌐 Apache Mod Cluster as load balancer (LB) - JBoss 6.4 🌐 Redirect traffic during maintenance 🧯 httpd (Apache) Error: systemd-tty-ask-password-agent tool! 🔐 SSL certificate supports Weak Ciphers 🔐 How to install opensource mod_security on Apache 2.4 📈 How to upgrade opensource apache from 2.4.39 to 2.4.46 (Minor Version Upgrade). 🛠️ What is Nginx & How to install on RHEL 🛠️ Install Nginx plus on RHEL 7.4 / UNIX 📊 Monitor Apache httpd process/thread status 📊 Monitor Apache httpd ModJK status 📊 Monitor Apache httpd Proxy balancer-manager status 📊 Monitoring of JBoss servers through Nagios.
🛡️ Tomcat ghostcat vulnerability (JBoss /Tomcat) 🛡️ SSL certificate supports Weak Ciphers/Encoding (3DES) (Apache 2.4) 🛡️ SSL Medium Strength Cipher Suites Supported (SWEET32) [Tomcat Server] 🛡️ ETag vulnerability & X-Powered-By : jsp/2.2 🛡️ Missing Security Header(x-xss-protection) & Clickjacking 🛡️ Disable HTTP TRACE / TRACK / OPTIONS/DELETE Method. 🛡️ Information disclosure through server response headers Apache-Coyote & X-Powered-By (JBoss) 🛡️ Local File Inclusion Vulnerabilities OR Directory traversal attack 🛡️ HTTP Host Header Injection (Apache 2.4) 🛡️ Restrict application Accessible by IP Address & HTTP Host Header Injection (Apache 2.4) 🛡️ Disable/Remove Server: Apache header info version (Apache2.4) 🔐 TLS1.2 Protocol enable for IBM WebSphere with SSL Handshake Debug
🌩️ How I Cleared My AZ-900 Microsoft Azure Fundamentals Exam 🌐🧱 Enterprise Network Architecture — Akamai, DNS, WAF, DMZ, SSL & Firewall Flow Explained for Middleware & DevOps Engineers 🌩️ AZ-104 Microsoft Azure Administrator 🌩️ Cloud Computing Basics
⚙️ DevOps vs DevSecOps Explained:Learning Path for Beginners 💻 Top 100+ Linux Commands for Middleware & DevOps Engineers 🐧 Linux Shell Scripting for Beginners – Complete Tutorial Series 🔐 Preparing WinRM on Windows Server over HTTPS for Automation (5986) 🔁 WAS Service Restart Using WinRM over HTTPS (5986) on Azure DevOps
☕ how-to-manually-install-new-java-path ☕ SunCertPathBuilderException ☕ out of space in CodeCache for adapters ☕ What is GC , Heap Memory & Metaspace ? ☕ Types of GC , analyze GC logging and REDHAT JVM Tool. 🧪 How to make datasource test-connection to Oracle / PostgreSql / MSSQL DB Instance.. 🧪 How to make datasource test-connection to MSSQL DB Instance 🧪 How to make datasource test-connection to Postgresql DB Instance 🧪 How to make datasource test-connection to Oracle DB Instance 🧪 How to Check DB latency using Datasource Test-Connection ☕ Install a new java path to the alternatives 🧰 Xmanager and Set Display. 🛠️ Install LAMP on SUSE Linux with example
🔐 Openssl Commands for Wildcard & SAN certificates. 🔐 What is SSL, What is One-Way SSL & Two-Way SSL? 🔐 Openssl Self-Signed SAN's certificate 🔐 SSL certificate supports Weak Ciphers 🔐 Some SSL issues (Client TLS1.2 , Truststore & SSL debug) with Solutions 🔐 TLS / SSL Certificate Lifetimes Reduced to 47 Days. 🔐 SSL Certificate Renewal on Akamai WAF and Its Impact on Applications. ✨ Worked on VMC SSL Today – A Simple Explanation for Everyone 📌WebSphere Outbound SSL & SNI – Troubleshooting Guide
🏢 Enterprise Authentication & Identity Security Series 🔐 Part 1 - What is Authentication? 🆔 Part 2 - Sessions, Cookies & JSESSIONID ⚖️ Part 3 - Stateful vs Stateless Applications 🎫 Part 4 - JWT (JSON Web Token) & Token-Based Authentication 📊 Part 5 - JWT vs Session vs Cookies Explained 🚪 Part 6 - API Authentication & API Gateway Security 🔄 Part 7 - OAuth2, OIDC & SAML Explained ☁️ Part 8 - SSO (Single Sign-On), MFA & Microsoft Entra ID 🟦 Part 9 - WebSphere LTPA, Sticky Sessions & Session Replication 🛡️ Part 10 - Zero Trust Security & Authentication Risks

11 Jul 2020

ETag vulnerability & X-Powered-By : jsp/2.2

  • ETags from Web servers are also considered an information leakage vulnerability on web-server.
  • Apache (httpd.conf & ssl.conf)
  • Enable "LoadModule headers_module modules/mod_headers.so" 

*************************************************************
LoadModule headers_module modules/mod_headers.so

Header unset Server
Header unset Etag
ServerSignature Off
ServerTokens Prod
TraceEnable off

*************************************************************

To test: curl –I  http://ipAddressOrHostName:port




Disable X-Powered-By on (apache-Web / IBM HTTP Server).

  • As the "x-powered-by: jsp/2.2" version is provided by application servers, that can be mitigated on Web-server also.
  • Apache (httpd.conf & ssl.conf)
  • Enable "LoadModule headers_module modules/mod_headers.so" 

*************************************************************
LoadModule headers_module modules/mod_headers.so

Header always unset "X-Powered-By"
Header unset "X-Powered-By"

*************************************************************

To test: curl –I  http://ipAddressOrHostName:port



Thanks 😊



Posted by:
Tags: ,

1 comment:

  1. Anonymous19 Jun 2026, 20:40:00

    This article provides a useful explanation of the ETag information disclosure vulnerability and the security implications of exposing server details through HTTP headers such as X-Powered-By. The discussion highlights how seemingly minor misconfigurations can reveal sensitive information about application frameworks and server environments, potentially assisting attackers during the reconnaissance phase of a cyber attack.

    ReplyDelete

Subscribe to: Post Comments (Atom)