tags:

views:

844

answers:

6

How can we detect the programming language and technologies which are used for a site ? Is a site written in asp.net or php ?

( the extensions of pages are hidden for sure )

e.g StackOverflow

-- Edited 1 --

As it seems most of the methods are logical , or by thricks related to the intelligence & guess

and everyone have the same idea about it's uncertainty

I agree with most of the ideas , Knew some but got some hints ,

-- It isn't mentioned but what about Directory Browsing of the server , Disregard for it's illegality as a developer can it be helpful this way ?

+7  A: 

Some servers may format URLs, or use file extensions, or have extra headers that can give you hints, but it's impossible to tell 100%. HTTP is just a bunch of plain text when it comes down to what is sent from the server. The server could put anything it wants there.

madlep
+5  A: 

There is no generic way to detect a specific technology / programming language. But much of the time, the HTTP teaders might tell you something. (Of course the administrator can turn these off, or lie, so there is no way to be sure).

For instance, if I look at the HTTP headers for SO, I find:

Server: Microsoft-IIS/7.0

So it tells me the site runs on IIS7, so assumingly the Microsoft stack.

driis
It is; see http://blog.stackoverflow.com/2008/09/what-was-stack-overflow-built-with/ However, I've set up quite a few Tomcat/Java installations sitting behing IIS, so you can't tell, really...
Arjan
Thanks Arjan , I was eager to know
Sypress
+3  A: 

It's hit-and-miss.

  • You might be able to guess what framework is in use based off URL characteristics (script extensions, URL components such as ".do", etc.)
  • The site itself might contain a page stating what stack is used to support it, or logos for the same purpose (or the site owner might blog)
  • There might be something present in the page markup which states or hints at the underlying technology (presence of view state blobs, for example, denotes ASP.NET Web Forms)

However, the bottom line is, why does it matter? As far as I can tell, it doesn't.

Rob
A: 

You can't tell the language even if website has aspx or php extensions. Evil developers can create urls that will have aspx and php on the end but sites will be written in something else. (Never do this at your website, I beg you!)

You can try to find out hoster of the site through whois service. This way you can look through hoster's services and, for example, if he offers windows only hosting than you can be statistically quite sure that website is using ASP.NET.

freiksenet
Hate to point this out, but PHP is available for Windows, too. I'd also love to know why you "beg" developers not to mask their script extensions. What's the problem, really? It's perfectly legal to use whatever URI form you like - the "extension" actually makes no difference to the end user.
Rob
.aspx and .php decrease readability of links and add extra symbols to the link. Why would anyone want to add those deliberately?
freiksenet
Regarding Windows Server and PHP - I believe share should be very low comparing to ASP.NET. I don't see any single benefit of running PHP on windows server.
freiksenet
freiksenet , I agree with you
Sypress
freiksenet, whilst it's true that there's no benefit, that doesn't mean it doesn't happen. I know plenty of developers that could/should use Linux+Apache, but instead use Windows+IIS, and I'd feel fairly confident saying that there *will* be a statistically relevant number of non-ASP.NET Windows servers out there. (And most likely, they *wont* have gone into the IIS admin and removed the "Powered by ASP.NET" header which is enabled by default.
Peter Boughton
Someone might use WIMP if they're hosting a packaged web app that requires PHP and zhe happens to prefer IIS over Apache, or needs ASP.Net for some other web app and Mono just won't cut it.
outis
+2  A: 

Ask the owner/developer and hope they're honest.

Peter Boughton
Yes , maybe it's the best way :)
Sypress
A: 

Short of asking an honest programmer (is there such a thing?) it cannot be known (reliably).

The reason for this, of course, is obvious. You don't need to know what language is being used in order to interact meaningfully with the server, unless you are an attacker targeting specific known weaknesses in languages or libraries attached to them, in which case, if you flip the proposition around, not being able to know is probably a good thing.

Williham Totland