Home > Linux

Banner Grabbing

Banner grabbing is one of the most direct and effective techniques in network enumeration. It extracts identifying information from services by initiating a connection and reading the initial output (the “banner”) or by sending minimal input to provoke a response. Banners often reveal sensitive details such as service names, exact versions, frameworks, operating systems, encryption methods, internal hostnames, and even debug information. This chapter provides full-length, hands-on, deeply practical techniques for grabbing banners manually, automatically, and stealthily across multiple protocols.

Banner grabbing is crucial because accurate version identification directly influences exploit selection. If you misidentify a service version, you may use an incorrect exploit, causing detection or system instability. Proper banner grabbing helps pinpoint vulnerabilities with precision.

What Banners Reveal

Banners can expose:

  • Service name

  • Exact version number

  • Operating system or distribution

  • Framework in use

  • Supported protocols (TLS versions, SSH algorithms, SMTP extensions)

  • Internal paths or hostnames

  • Build dates

  • Debug or development information

  • Misconfigurations

  • Hidden and experimental ports

Every detail you extract becomes an actionable data point for exploitation.

Manual Banner Grabbing with Netcat

Netcat is the simplest, most powerful banner-grabbing tool.

Basic banner grab:

nc <target> <port>

Example (SSH):

nc 192.168.1.10 22

Typical output:

SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.7

Interpretation:

  • OpenSSH version

  • Ubuntu patch info

  • Protocol version

SSH banners alone can map to dozens of CVEs depending on version.

HTTP banner grabbing (GET request):

nc <target> 80
GET / HTTP/1.1

Look for:

  • Server header

  • Framework info

  • HTTP version

  • Cookies

Custom ports:

nc <target> 8080

Many admin panels and development services reveal verbose banners on non-standard ports.

Banner Grabbing with Telnet

Telnet behaves similarly to Netcat but sometimes triggers additional responses.

telnet <target> <port>

Example:

telnet 192.168.1.10 25

Likely output:

220 mail.example.com ESMTP Postfix (Ubuntu)

You now know:

  • Mail server type

  • Software version

  • Hostname

Banner Grabbing with OpenSSL (TLS/SSL Services)

To enumerate encrypted services such as HTTPS, SMTPS, FTPS, IMAPS:

openssl s_client -connect <target>:443

Interpretation focuses on:

  • Certificate subject

  • Issuer

  • Validity period

  • Supported TLS versions

  • Server banner in plaintext

  • Internal CN/SAN values

Look for misconfigurations such as:

  • Weak ciphers

  • Self-signed certificates

  • Mismatched hostnames

  • Expired certs

Extract Server header manually:

echo -e "HEAD / HTTP/1.1\nHost: <target>\n\n" | openssl s_client -connect <target>:443 -quiet

Banner Grabbing with Curl

Curl is extremely useful for grabbing HTTP/HTTPS banners.

Only headers:

curl -I http://<target>

Typical output:

Server: nginx/1.14.0
X-Powered-By: PHP/7.2.24

Full verbose output:

curl -v http://<target>

Shows redirects, cookies, server info, and internal routing behavior.

HTTPS with ignored cert:

curl -vk https://<target>

Shows:

  • TLS handshake

  • Cipher details

  • Certificate chain

  • Server header

Banner Grabbing with Nmap (Automated)

Nmap identifies banners using service detection.

nmap -sV <target>

Deep detection:

nmap -sV --version-all <target>

HTTP banner extraction:

nmap --script=http-headers -p80 <target>

SSH banner extraction:

nmap --script ssh2-enum-algos -p22 <target>

SMTP banner extraction:

nmap --script smtp-commands -p25 <target>

Automated scripts gather extensive banner and protocol data for you.

Banner Grabbing with ZGrab (Advanced)

ZGrab is a high-speed banner-grabbing tool useful for automation or large-scale scans.

Example HTTPS grab:

zgrab --port 443 --tls --domain <target>

Use cases:

  • Bulk scanning

  • Internet-wide reconnaissance

  • Large enterprise environments

Banner Grabbing for Individual Protocols

SSH

nc <target> 22

Grab:

  • SSH version

  • OS info

  • Key exchange algorithms

FTP

nc <target> 21

Look for:

  • Server type (vsftpd, proftpd)

  • Version number

  • Vulnerable builds (e.g., vsftpd 2.3.4 backdoor)

SMTP

nc <target> 25

Look for:

  • Mail server type

  • Software version

  • VRFY & EXPN support

POP3 / IMAP

nc <target> 110
nc <target> 143

Look for:

  • Dovecot

  • Courier

  • Cyrus IMAP

SMB

Grab via Nmap:

nmap -p445 --script smb-os-discovery <target>

Redis

nc <target> 6379
PING

Telnet

nc <target> 23

Often reveals OS banners directly.

Detecting Hidden Banners

Some services hide banners on initial connection but reveal them after sending malformed input.

Examples:

nc <target> <port>
^C

or sending random bytes:

echo "AAAAAAA" | nc <target> <port>

HTTP hidden banner trick:

curl -I -H "User-Agent: test" http://<target>

SSH hidden identification:

ssh -vvv <target>

Verbose output exposes full handshake information.

Stealthy Banner Grabbing

Intrusion detection systems may detect overt banner grabbing.

Use low-profile techniques:

Slow connection:

nc -w 3 <target> <port>

Fragmented TCP (Nmap):

nmap -sS -f -sV <target>

Randomized scan:

nmap -sV -D RND:10 <target>

These help avoid IDS/IPS detection.

Exploitation Through Banners

Once you gather banners, exploit them.

Example 1: Outdated Apache

Banner:

Server: Apache/2.4.29

Check CVEs:

searchsploit apache 2.4.29

Example 2: Vulnerable OpenSSH

Banner:

OpenSSH_7.6p1 Ubuntu

Look for privilege escalations tied to that version.

Example 3: Redis No-Auth

Banner:

redis_version:3.0.504

Version known for RCE chaining.

Example 4: SMTP Server with EXPN Support

220 mail.example.com ESMTP Postfix

EXPN → User enumeration.

Example 5: vsftpd 2.3.4 Backdoor

Banner:

220 (vsFTPd 2.3.4)

This version has a hardcoded backdoor that provides a shell.

Intel Dump

  • Banners reveal versions, OS info, frameworks, certificates, and more

  • Netcat is the simplest and most powerful banner-grabbing tool

  • Telnet and OpenSSL help extract banners from specific protocols

  • Curl retrieves HTTP/HTTPS headers and server details

  • Nmap (-sV, NSE scripts) automates banner enumeration

  • ZGrab enables high-speed automated banner collection

  • Each protocol has unique banner extraction techniques

  • Hidden banners appear after malformed input or verbose flags

  • Stealth methods help evade IDS/IPS detection

  • Banner grabbing directly supports CVE matching and exploit execution

  • Vulnerable versions like vsftpd 2.3.4, Apache 2.4.x, and old OpenSSH show up immediately through banners

HOME LEARN COMMUNITY DASHBOARD