Syntactic   Per the HTTP RFC, all web communications are required

to have a predefined structure and composition so that both parties

can understand each other.  Variations in the HTTP Response

header ordering and format still exist.

Header Ordering   Apache servers consistently place the  Date 

header before the  Server  header while Microsoft IIS has these

headers in the reverse order.

Apache 1.3.29  HEAD

Microsoft IIS/4.0

  HEAD

# telnet target1.com 80

# telnet

Trying target1.com...

target2.com 80

Connected to target1.com.

Trying

Escape character is  ^] .

target2.com...

HEAD / HTTP/1.0

Connected to

target2.com.

HTTP/1.1 200 OK

Escape character

Date: Mon, 07 Jun 2004

is  ^] .

15:21:24 GMT

HEAD / HTTP/1.0

Server: Apache/1.3.29 (Unix)

mod_perl/1.29

HTTP/1.1 404

Content Location:

Object Not Found

index.html.en

Server: Microsoft 

Vary: negotiate,accept 

IIS/4.0

language,

Date: Mon, 07 Jun

accept charset

2004 15:22:54 GMT

TCN: choice

Content Length:

Last Modified: Fri, 04 May

461

2001 00:00:38 GMT

Content Type:

ETag: "4de14 5b0 

text/html

3af1f126;40a4ed5d"

Accept Ranges: bytes

Connection closed

Content Length: 1456

by foreign host.

Connection: close

Content Type: text/html

73

Copyright 2004, Web Application Security Consortium. All rights reserved.