How to get info about given webserver FAST?

Question

$ time nmap -q -sV -P0 -p80 google.com | fgrep '80/tcp open'
80/tcp open  http    Google httpd 2.0 (GFE)

real    0m6.563s
user    0m0.280s
sys 0m0.016s
$ 

Are there any faster methods to get info about the webserver?

Google httpd 2.0 (GFE) is enough

Answer 1

For most HTTP servers, Nmap simply grabs the Server header, so that could be enough. To get that information, try this:

printf "HEAD / HTTP/1.0\r\nHost: $TARGET\r\n\r\n" | nc $TARGET 80 | awk '$1=="Server:"{$1="";print}'

Otherwise, if you want to use Nmap, there are some ways you could speed things up.

• Use -n to avoid doing name resolution
• Use --version-light or --version-intensity 0 to reduce the number of probes sent. This won't have an effect for most HTTP servers, since the default probe is usually the one that matches.
• Use -Pn to skip host discovery. You already have this as -P0, which works, but is older syntax.

All together, these will save a few milliseconds. Unfortunately, the 6 seconds that you are seeing is Nmap waiting for the server to send data first. Nmap tries service detection probes in a particular order: first the NULL probe (wait for server to send first), then any probes that are "for" the port being scanned, then any other probes with a rarity less than the version intensity (default 7). The probes and their ports and rarities are defined in the nmap-service-probes file, which you could edit. This is a global setting, though, so you will be making Nmap less useful for general version detection if you edit it. Find the Probe TCP NULL line, and change the totalwaitms value below it to something small, like 100. It should look something like this:

# This is the NULL probe that just compares any banners given to us
##############################NEXT PROBE##############################
Probe TCP NULL q||
# Wait for at least 6 seconds for data.  It used to be 5, but some
# smtp services have lately been instituting an artificial pause (see
# FEATURE('greet_pause') in Sendmail, for example)
totalwaitms 100

To avoid messing up Nmap for all other scans, make a copy of the nmap-service-probes file and refer to its location with the --datadir option. Here is the result I got:

$ time nmap -Pn -sV -n -p80 $TARGET --datadir=. | grep '^80/tcp'
80/tcp open  http    Google httpd 2.0 (GFE)

real    0m0.753s
user    0m0.472s
sys     0m0.032s

Answer 2

How about:

wget -q -O /dev/null -S www.google.com