calderonpale.com

A few months ago I submitted an article to Pentest Magazine called "Gathering web server information with Nmap NSE".

Excerpt

HTTP response analysis with Nmap

Widely used protocols are always at the mercy of the
developers implementing it and HTTP is no exception.
Specially crafted requests make web servers behave in
its own way and this allow us to do some nifty tricks to
fingerprint them.