Hiding the backend technology stack

Question

As a security measure, I want to hide the technology stack I am using on my server. What are effective ways to do this? I thought about

1) Use mod_rewrite or Rewrite Module to hide any page extensions like .php or .aspx
2) Turn off all error reporting

1b) use mod_rewrite to serve a misleading extension on purpose, like disguising a php page as aspx
2b) Throw misleading errors to go with 1b), making my php pages display asp-like errors.

Answer 1

You can add fake Server: and/or X-Powered-By headers to the response, pretending that it was generated by a different server. (Or, Server: My Unhackable Server)

Answer 2

1. Don't show accurate page extensions
2. Don't use standard error pages
3. Make sure the web server and application layer (ASP.NET, PHP et al) hide their presence in browser headers)
4. If your error pages do anything dynamic, assume that this can fail somehow and have a set of static html pages you can serve that aren't the web servers default ones
5. Make sure all of our technolog stacks are configured to not show stack traces on any error pages served to machines other than the local server. If for some reason all your custom errors fail then the user may see the technology stack, but they won't have a window into the underlying code

Answer 3

This is an impossible task. You will have to modify the entire stack, in which case you will have just created new buggy versions that you now have to keep in sync with vendor's versions.

There's literally no way to do this without making your site less secure.

You can do lame stuff like remove X-Powered-By, or change the session generation scheme if it's using something like ASP or PHP which has a known one. The fact is it's not going to stop anyone who actually wants to know what you are running.

For basic examples (it goes much deeper than this), some web servers will accept any header, so I can say GET LOLOLOL HTTP/1.1 and it will still work. Some stacks will keep the session alive, some wont. You can also see what features are on the stack, since there are just so many on the web and there's no way on earth any stack supports the exact same set.