I have to either look for a file where the version is encoded or perhaps a method of polling it over the web therefore it discloses its version. The server is running in a host who'll not provide me command line access, although I'm able to see the install location via ftp.

Update 1:

I've attempted Mind and don't obtain a version number reported.

Basically consider using a missing page to obtain a 404 it's intercepted along with a stock page is came back without any server info on it. I suppose that points towards the server being hardened.

Still no closer...

Update 2: I put a php file as recommended however i can't browse into it and should not quite determine the URL path that will load it. Regardless I get lots of access refused messages and also the same stock 404 page. I'm a little comfort from understanding that the server is quuite robustly protected.

The technique

Connect with port 80 around the host and send it

HEAD / HTTP/1.0

This must be then carriage-return + line-feed two times

You will get back something similar to this

HTTP/1.1 200 OK
Date: Fri, 03 Oct 2008 12:39:43 GMT
Server: Apache/2.2.9 (Ubuntu) DAV/2 SVN/1.5.0 PHP/5.2.6-1ubuntu4 with Suhosin-Patch mod_perl/2.0.4 Perl/v5.10.0
Last-Modified: Thu, 02 Aug 2007 20:50:09 GMT
ETag: "438118-197-436bd96872240"
Accept-Ranges: bytes
Content-Length: 407
Connection: close
Content-Type: text/html; charset=UTF-8

After that you can extract the apache version in the Server: header

Typical tools you should use

You could utilize the Mind utility which has a full install of Perl's LWP library, e.g.

HEAD http://your.webserver.com/

Or, make use of the curl utility, e.g.

 curl --head http://your.webserver.com/

You might make use of a browser extension which allows you view server headers, for example Live HTTP Headers or Firebug for Opera, or Fiddler for IE

Tied to Home windows?

Finally. if you are on Home windows, and also have little else available, open an order prompt (Start Menu->Run, type "cmd" and press return), after which type this

telnet your.webserver.com 80

Then type (carefully, your figures will not be echoed back)

HEAD / HTTP/1.0

Press return two times and you will begin to see the server headers.

Other techniques

As pointed out by cfeduke and Veynom, the server might be set to come back limited information within the Server: header. Try to upload a PHP script for your host with this particular inside it

<?php phpinfo() ?>

Request the page having a internet browser and you ought to begin to see the Apache version reported there.

You might try to use PHPShell to possess a poke around, consider using a command like

/usr/sbin/apache2 -V

Rarely a hardened HTTP server is set up to provide no server information or misleading server information. In individuals situations when the server has PHP enabled you can include:

<?php phpinfo(); ?>

inside a file and study into it and search for the

_SERVER["SERVER_SOFTWARE"]

entry. This really is prone to exactly the same solidifying insufficient info/misleading though I'd suppose it is not changed frequently as this method first requires use of the device to produce the PHP file.

telnet towards the host at port 80 type:

get / http1.1
::enter::
::enter::

It's type of an http request, nevertheless its not valid therefore the 500 error it provides you with will most likely provide you with the information you would like. The the blank lines in the finish are essential otherwise it'll just appear to hold.

Should they have error pages enabled, you can turn to a non-existent page and check out the foot of the 404 page.