Banner Grabbing

What Is Banner Grabbing?

Banner grabbing means connecting to a network service and reading the text it sends back about itself. That text, the banner, often names the software, its version and sometimes the operating system underneath. One line such as SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.13 can tell a stranger what runs on a server and roughly how old it is.

It is a reconnaissance step, and both sides use it. MITRE ATT&CK lists server banners among the ways attackers gather information about a victim’s host software (T1592.002). Defenders run the same checks to see their own attack surface the way an outsider does.

Banner grabbing is not an exploit. It sends ordinary protocol traffic, such as a new connection or a request for page headers. What makes it matter is the next step: matching the version to known flaws, each tracked as a CVE.

Where Does a Banner Come From?

Many protocols ask a server to introduce itself, so a banner is often there by design. Some services speak first as soon as a connection opens. Others stay silent until the client sends a request. Nmap’s version detection notes say most FTP, SSH, SMTP, Telnet, POP3 and IMAP servers greet a new client with a banner.

The SSH standard, RFC 4253, makes the version line mandatory. Its form is “SSH-protoversion-softwareversion comments”, and the software part tells the other side what the program can do. The mail standard, RFC 5321, lets an SMTP server add its software and version after the 220 code. It also lets the software turn that off.

For the web, RFC 9110 defines the Server header. It warns against “needlessly fine-grained detail”, since long values can make it “(slightly) easier for attackers to find and exploit known security holes”. Databases follow their own rules. A MariaDB server opens each connection with a handshake packet that carries its version and the name of its sign-in plugin, per the MariaDB protocol docs.

What Do Real Banners Reveal?

We grabbed six banners on 10 November 2026 and wrote down what each one tells an outsider. Two come from scanme.nmap.org, a host the Nmap Project runs for practice. Its home page says: “You are authorized to scan this machine with Nmap or other port scanners.” The other four come from public container images on a test machine in our lab, read on the machine itself through 127.0.0.1.

Capture 1: SSH on scanme.nmap.org. SSH speaks first, so netcat only has to connect.

$ nc -v scanme.nmap.org 22
Connection to scanme.nmap.org port 22 [tcp/ssh] succeeded!
SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.13

The line gives the protocol (2.0), the software (OpenSSH 6.6.1p1) and an Ubuntu package suffix. Launchpad, Ubuntu’s package site, lists openssh 1:6.6p1-2ubuntu2.13 as a security update for Ubuntu 14.04 “Trusty”, uploaded on 4 March 2019. Ubuntu’s release cycle page shows standard security maintenance for 14.04 ending in April 2019.

Capture 2: HTTP on scanme.nmap.org. A web server waits for a request, so curl asks for the headers only.

$ curl -sI http://scanme.nmap.org/
HTTP/1.1 200 OK
Date: Tue, 10 Nov 2026 18:27:35 GMT
Server: Apache/2.4.7 (Ubuntu)
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Type: text/html

The Server header names Apache 2.4.7 and Ubuntu. That is the Apache release Ubuntu 14.04 shipped, 2.4.7-1ubuntu4 on Launchpad.

Two services on one host now tell the same story: an Ubuntu release that left standard support in 2019. The scanme host is a practice target, so its age is no secret. On a production host, the same two lines would tell an attacker which advisories to read first.

Capture 3: a WordPress test site in our lab. Six headers that say nothing about the software are left out below.

$ curl -sI http://127.0.0.1:8090/
HTTP/1.1 301 Moved Permanently
Server: Apache/2.4.65 (Debian)
X-Powered-By: PHP/8.1.34
X-Redirect-By: WordPress
Location: http://localhost:8090/

One request shows three layers. The Server header names Apache 2.4.65 on Debian. X-Powered-By gives the exact PHP version, which PHP sends by default through its expose_php setting. X-Redirect-By names WordPress.

PHP 8.1.34 is the last release of the 8.1 branch, which reached end of life on 31 December 2025 (PHP end-of-life list). An attacker now knows this stack gets no more PHP security releases.

Capture 4: a mail service in our lab.

$ nc -v 127.0.0.1 1025
Connection to 127.0.0.1 port 1025 [tcp/blackjack] succeeded!
220 051e63b72a76 Mailpit ESMTP Service ready

Mail servers greet first with a 220 line, and RFC 5321 puts the server’s host name right after the code. Here the software is Mailpit, an email and SMTP testing tool, and the host name is 051e63b72a76. That string is the container’s ID, because Docker uses the ID as a container’s host name unless told otherwise (Docker networking docs).

On a production mail server, the same field can name an internal host. The [tcp/blackjack] label is only the name netcat found for port 1025 in the local service list.

Capture 5: a MariaDB database in our lab. The lab maps the container’s port 3306 to 3390.

$ nc 127.0.0.1 3390 | strings
11.4.13-MariaDB-ubu2404
TU11B98I
Jv3;m5_^<NR4
mysql_native_password

The database speaks first with a binary handshake, so strings pulls out the readable parts. Line one is the exact version, 11.4.13, with a build tag. The container runs Ubuntu 24.04, which matches “ubu2404”.

The two random lines are data the server sends for the password exchange. The last line names the sign-in method the server offers.

Capture 6: a Redis cache in our lab. Redis said nothing on connect, so we sent one command.

$ printf 'INFO server\r\n' | nc 127.0.0.1 6379 | head -8
$627
# Server
redis_version:7.4.9
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:5a23d515cf8f8935
redis_mode:standalone
os:Linux 6.8.0-117-generic aarch64

It answered at once, which shows the first fact an attacker wants: no password was asked. The reply names the version, the kernel and the processor type, and the full answer runs to 627 bytes. An open Redis like this is a classic security misconfiguration. Redis’s own security guide says it “is designed to be accessed by trusted clients inside trusted environments”.

How Do You Grab a Banner?

Run these only against systems you own or have written permission to test. Nmap’s guide to legal issues advises written authorization before any scan, and notes that laws “differ dramatically between jurisdictions”. The practice host scanme.nmap.org is open to scans, but its page says a few scans a day is fine and 100 is not.

Nmap’s version detection, switched on with -sV, automates the job. After a connection opens, it listens for about five seconds for a greeting and compares what it gets with about 3,000 signatures for first replies. If nothing arrives, it sends probes one by one. The Nmap reference guide says its database holds about 6,500 pattern matches for more than 650 protocols.

nmap -sV --version-intensity 0 host   # fewest probes, fastest
nmap -sV host                          # default intensity 7
nmap -sV --version-all host            # every probe (intensity 9)
nmap -sV --version-trace host          # print what each probe did

Intensity runs from 0 to 9, and --version-light is the same as 2. The guide says higher numbers make a correct match more likely, but high intensity scans take longer.

How Is Banner Grabbing Different From Port Scanning?

The terms overlap, but each answers a different question. Nmap runs version detection on the ports that its port scan has already found open, so the steps usually come in this order.

What Is the Difference Between Active and Passive Banner Grabbing?

Active banner grabbing is what the commands above do: you connect to the target and read its reply. The target can log that connection. Passive banner grabbing reads banners that someone else already collected, so nothing you send reaches the target.

The usual source is a search engine for internet-connected devices. Shodan’s help page says “the bulk of the data is taken from banners, which are metadata about a software that’s running on a device” (What is Shodan?). Its FTP example, “220 kcg.cz FTP server (Version 6.00LS) ready”, gives a host name, a server type and a version.

Censys is another such index. Qualys searched both when it sized the regreSSHion exposure, as the section on attackers shows.

How Do Attackers Use Banner Grabbing?

The banner is the bridge between finding a service and choosing an exploit. MITRE says vulnerability scans check whether “software and version” match “the target of a specific exploit”. Such scans “typically harvest running software and version numbers via server banners” (T1595.002). This happens before the attacker touches anything inside the network.

CVE-2024-6387, called regreSSHion, shows the method at scale. Qualys researchers found the flaw in OpenSSH’s server and disclosed it on 1 July 2024. They wrote that “based on searches using Censys and Shodan, we have identified over 14 million potentially vulnerable OpenSSH server instances exposed to the Internet” (Qualys).

The affected range starts at 8.5p1 and stops before 9.8p1. Versions before 4.4p1 are also at risk unless they carry two older fixes. Because an OpenSSH server names its version in its first line, anyone with banner data could build a similar list. Our regreSSHion news report covers the flaw itself.

Our own data shows which doors sellers name. For the Initial Access chapter of the Brandefense Cybercrime Report 2026, we read 120 corporate network access listings that Brandefense Blackhole collected from 1 January to 27 October 2026. Counting one repeated firewall template once, 48 of 106 listings (45%) named a firewall, network device, Citrix, Fortinet, RDP, VPN or RDWeb as the way in.

These are internet-facing services that a banner or login page can identify from outside. The details are in our anatomy of a corporate network access listing. Every field is a seller’s claim, and we do not know how each seller found its target.

Sellers of this kind of access are called initial access brokers. The exploit chapter of the same report adds the tools. Of 193 seller posts in its sample, 36 sold a mass-exploitation tool and 20 sold the web shells such tools produce.

One, a bot advertised on 20 January, claimed to automate scanning and shell upload for WordPress sites (what a 0-day ad really sells). A tool like that must find WordPress sites first, and a header like X-Redirect-By: WordPress in capture 3 is one way to spot them.

Why Can a Banner Mislead You?

A banner is what a service claims about itself, and it can be wrong in both directions. The common error is a false alarm caused by backporting. Red Hat describes backporting as taking a fix “out of the most recent version of an upstream software package” and applying it to the older version it ships. It warns that tools which decide “based solely on the version number” produce false positives (Red Hat on backporting).

regreSSHion is a clear case. Debian 12 (bookworm) ships OpenSSH 9.2p1, which sits inside the affected range. Debian fixed it in package 1:9.2p1-2+deb12u3 (DSA-5724-1), and the upstream number stayed 9.2p1 (Debian security tracker).

The Debian and Ubuntu banner adds a distribution suffix by default, like 2ubuntu2.13 in capture 1. So read the whole line, not only the upstream version.

Qualys made the same point about its own checks. Remote scans without a login mark regreSSHion only as potential, because they “primarily depend on the information presented by the OpenSSH service banner”.

The reverse error happens too. An admin can change or remove a banner, so a quiet or odd banner does not prove a service is safe. That is why Nmap also probes how a service answers, not only what it announces.

Should You Hide or Change Your Banners?

Trim them, but do not count on it. The Apache documentation is blunt: “disabling the Server: header does nothing at all to make your server more secure”, and security through obscurity “is a myth” (ServerTokens). RFC 5321 records the same debate for mail. Those who favor showing the version argue it is “far better to actually secure an SMTP server” than to hope concealment helps.

The sensible middle is to remove detail that helps nobody outside, such as exact versions, operating system names, module lists and internal host names. Then spend the real effort on patching and on closing what should not be public. A trimmed banner keeps a server out of simple version searches. It does not stop a scanner that probes behavior.

How Do You Check What Your Own Servers Reveal?

1. List every internet-facing IP address and host name, including cloud hosts, test servers and forgotten subdomains. Shadow IT often hides the surprises, and the EASM 101 guide explains how to build the list.
2. Grab the banner of every open port from outside your network, using the commands above. Record the host, port, date and full banner line.
3. Match each product and version against your distribution’s security notices, not only upstream numbers, because of backporting. Check the Known Exploited Vulnerabilities catalog first.
4. Take management interfaces off the internet. CISA’s BOD 23-02 covers interfaces reached over HTTP, HTTPS, FTP, SNMP, Telnet, TFTP, RDP, rlogin, RSH, SSH, SMB, VNC and X11. It gives US federal agencies 14 days to make each one internal only, or to put access control in front of it.
5. Remove needless detail from the banners that stay public, using the settings above. Then grab them again to confirm the change.
6. Search your own address ranges and domain names in a banner search engine, to see what anyone can read without sending a packet. Compare the results with what you think you run.
7. Repeat after every change and on a fixed schedule, since a new service can go live without anyone updating the list.

When a banner points to an old or unsupported version, treat it as a lead, not a verdict. Confirm the installed package on the host, then patch or upgrade, and limit who can reach the service. Review that service’s logs from the time it was exposed, because a banner you can read was readable to others too.

A penetration test can go further and check whether a version is really exploitable. For the most common finding, see exposed admin panels and open ports.

Brandefense External Attack Surface Management keeps that inventory, and its Misconfiguration Detection module checks every internet-facing IP and host name for open ports and fingerprinted services.