What Is Banner Grabbing?
Banner grabbing reads the identifying text a service hands out when you connect to it — a web
server’s Server header, an SSH version string, an FTP greeting. That banner often names the exact
software and version, which is gold for reconnaissance: version plus a
CVE lookup equals a list of exploits to try. It is a small technique
with outsized value in enumeration.
How does it work?#
Many services volunteer their identity on connection:
$ connect to port 22
SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.1 ← the banner
$ HTTP request →
Server: nginx/1.18.0 ← the bannerAn attacker reads these to fingerprint the stack. Combined with the open port, the version string tells them not just that a service exists but exactly which one — and whether it has published vulnerabilities.
Is hiding banners a real defense?#
Only weakly. Suppressing or faking banners is obscurity: it cuts casual-scan noise but does nothing about the actual vulnerability, and skilled attackers fingerprint services by their behavior regardless of the banner.
| Action | Value |
|---|---|
| Patch the software | Real — removes the vulnerability |
| Suppress the banner | Minor — slows casual recon only |
| Rely on hidden version | False security |
Banner grabbing is a fingerprinting technique within enumeration. More at the Network Security hub.
Frequently asked questions#
What is banner grabbing?
Banner grabbing is connecting to a network service and reading the identifying information — the "banner" — it returns, such as a web server’s Server header or an SSH version string. This reveals the software and often the exact version, which an attacker uses to look up known vulnerabilities for that version.
Should you hide service banners?
Suppressing or altering banners is minor obscurity, not real defense. It can slow casual scanning and reduce noise, but attackers fingerprint services by behavior regardless, and it does nothing about the underlying vulnerability. Patching the software is what matters; hiding the banner is at best a small extra layer.