---
title: "Banner Grabbing"
canonical: https://trickest.com/glossary/banner-grabbing
description: "Banner grabbing reads the identifying text a service returns on connection, such as a server header or SSH version string, to reveal the product and version in use."
---

# Banner Grabbing

Banner grabbing reads the greeting a service sends when you connect. An SMTP server announces its software in the 220 line, SSH replies with a version string before authentication, and a web server often returns Server and X-Powered-By headers. Each banner names a product and frequently a version, which tells an attacker what they are facing before they send a single attack.

That version string is the bridge to exploitation. Once you know a host runs an outdated build, you can match it against known vulnerabilities and decide whether an attack is worth attempting. Banner grabbing usually follows [port scanning](/glossary/port-scanning), which finds the open ports, and feeds [service fingerprinting](/glossary/service-fingerprinting), which confirms the service when a banner is missing, spoofed, or deliberately scrubbed. The results enrich an [asset discovery](/glossary/asset-discovery) inventory and a broader [network mapping](/glossary/network-mapping) effort with software detail.

Banners lie. Administrators strip or fake them, and reverse proxies hide the real backend, so treat a banner as a hint to verify rather than ground truth.

In a Trickest workflow you grab banners across thousands of hosts in parallel right after a scan, then match the parsed product and version against vulnerability data so exposed legacy software rises to the top automatically.

---
_Markdown source of https://trickest.com/glossary/banner-grabbing._