# RedHat Apache Banner OS Finger Print

**URL:** <https://discuss.rapid7.com/t/redhat-apache-banner-os-finger-print/595>\
**Category:** InsightVM\
**Created:** [April 22, 2020, 2:12pm UTC](https://discuss.rapid7.com/t/redhat-apache-banner-os-finger-print/595 "2020-04-22T14:12:09Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![brian\_w\_gray](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/brian_w_gray/32/112_2.png) [@brian\_w\_gray](https://discuss.rapid7.com/u/brian_w_gray)\
**Post date:** [April 22, 2020, 2:12pm UTC](https://discuss.rapid7.com/t/redhat-apache-banner-os-finger-print/595/1 "2020-04-22T14:12:09Z")

</div>

Yesterday, I was looking through some Red Hat servers that were just showing up as Linux when I knew there were banners with Red Hat readily available. It looks like the banners have been altered just enough that the existing finger print regex doesn’t catch the vendor any more.

```auto
"Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips"

```

The existing apache banner fingerprints within rapid7/nexpose/plugins/fp/builtin/apache\_os.xml

```auto
<fingerprint pattern=".*\(RHEL\).*">
  <description>Red Hat Enterprise Linux</description>
  <param pos="0" name="os.vendor" value="Red Hat"/>
  <param pos="0" name="os.family" value="Linux"/>
  <param pos="0" name="os.product" value="Enterprise Linux"/>
  <param pos="0" name="os.cpe23" value="cpe:/o:redhat:enterprise_linux:-"/>
</fingerprint>
<fingerprint pattern=".*\(Red[-]Hat(?:[/]Linux)?\).*">
  <description>Red Hat Linux</description>
  <param pos="0" name="os.vendor" value="Red Hat"/>
  <param pos="0" name="os.family" value="Linux"/>
  <param pos="0" name="os.product" value="Linux"/>
  <param pos="0" name="os.cpe23" value="cpe:/o:redhat:linux:-"/>
</fingerprint>

```

I ended up adding a custom fingerprint under /rapid7/nexpose/plugins/fp/custom/apache\_os.xml

```auto
<?xml version="1.0" encoding="UTF-8"?>
<fingerprints matches="apache_os" database_type="util.os" preference="0.10">
  <!--
  When an HTTP server is fingerprinted as Apache, a 2nd analysis pass is done
  on the server headers HTTPProtocolHelper.SERVER_HEADERS: they are matched
  against the following patterns to extract OS information.
  The following fingerprints are customized to improve detection within our
  environment - BrianGr last update (04/20/2020)
  -->
  <fingerprint pattern=".*\(Red Hat Enterprise (?:Linux)?\).*">
    <description>Red Hat Linux</description>
    <param pos="0" name="os.vendor" value="Red Hat"/>
    <param pos="0" name="os.family" value="Linux"/>
    <param pos="0" name="os.product" value="Linux"/>
    <param pos="0" name="os.cpe23" value="cpe:/o:redhat:enterprise_linux:-"/>
  </fingerprint>
</fingerprints>

```

So far the fingerprint looks like it’s doing what I intend it too but **does anyone know the actual order of precedence for the finger printing with a custom regex?** I don’t recall the preference values implementation well enough that I felt comfortable editing it. It doesn’t match the fingerprint certainty values so I didn’t want to make any additional assumptions.

---

<div class="post-metadata">

**Author:** ![brent\_cook](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/b/839c29/32.png) [@brent\_cook](https://discuss.rapid7.com/u/brent_cook)\
**Post date:** [April 22, 2020, 6:47pm UTC](https://discuss.rapid7.com/t/redhat-apache-banner-os-finger-print/595/2 "2020-04-22T18:47:18Z")

</div>

Good question, I think it’s top to bottom as a quite a few other things are, but will ask if anyone else can chime in that would be great. We might want to grab your regex fix too if that’s OK, thanks for the note!

---

<div class="post-metadata">

**Author:** ![brent\_cook](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/b/839c29/32.png) [@brent\_cook](https://discuss.rapid7.com/u/brent_cook)\
**Post date:** [April 22, 2020, 8:21pm UTC](https://discuss.rapid7.com/t/redhat-apache-banner-os-finger-print/595/3 "2020-04-22T20:21:31Z")

</div>

Ah, it is correct, the order of evaluation is top to bottom. Also, custom fingerprints take precedence over builtin ones.

---

<div class="post-metadata">

**Author:** ![brian\_w\_gray](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/brian_w_gray/32/112_2.png) [@brian\_w\_gray](https://discuss.rapid7.com/u/brian_w_gray)\
**Post date:** [April 22, 2020, 11:53pm UTC](https://discuss.rapid7.com/t/redhat-apache-banner-os-finger-print/595/4 "2020-04-22T23:53:44Z")

</div>

I’m always happy to have anything I work on shared/used to help others.

---

<div class="post-metadata">

**Author:** ![brent\_cook](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/b/839c29/32.png) [@brent\_cook](https://discuss.rapid7.com/u/brent_cook)\
**Post date:** [April 23, 2020, 3:14pm UTC](https://discuss.rapid7.com/t/redhat-apache-banner-os-finger-print/595/5 "2020-04-23T15:14:07Z")

</div>

Awesome. The fingerprint file here is a part of our open-source Recog fingerprint database: [https://github.com/rapid7/recog/blob/master/xml/apache\_os.xml](https://github.com/rapid7/recog/blob/master/xml/apache_os.xml) if you wanted to submit a PR, or happy to help do that too.

---

<div class="post-metadata">

**Author:** ![llannamal](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/l/59ef9b/32.png) [@llannamal](https://discuss.rapid7.com/u/llannamal)\
**Post date:** [October 19, 2022, 6:30pm UTC](https://discuss.rapid7.com/t/redhat-apache-banner-os-finger-print/595/6 "2022-10-19T18:30:06Z")

</div>

@brian_w_gray , We have a non standard linux distribution and our authenticated SSH /agents scans are not fingerprinting correctly. I am trying to add a fingerprint to map our custom OS which is a derivative of RHEL. I added this fingerprint in operating\_system.xml and saved this to the /fp/custom folder. Not having success with my manual scan. According to this help [Sending custom fingerprints to paired Scan Engines | InsightVM Documentation](https://docs.rapid7.com/insightvm/sending-custom-fingerprints-to-paired-scan-engines/)  
There is a way to test custom fingerprint. I can’t find the recog\_verify file though.

---

<div class="post-metadata">

**Author:** ![jdel-grande3](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/j/e495f1/32.png) [@jdel-grande3](https://discuss.rapid7.com/u/jdel-grande3)\
**Post date:** [January 15, 2026, 5:02am UTC](https://discuss.rapid7.com/t/redhat-apache-banner-os-finger-print/595/7 "2026-01-15T05:02:56Z")

</div>

Hi @brian_w_gray, to test out your customer fingerprints, you will need to download Recog from Github.

$ git clone [https://github.com/rapid7/recog.git](https://github.com/rapid7/recog.git)  
$ cd recog  
$ bundle install

Then you can test your custom fingerprint. Just make sure you have set so it can test you regex.

$ ./bin/recog\_verify customfootprint.xml

Hope that helps.

Cheers,

Jordan