Is there anyway to tell if a website is coded in PHP or ASP

Question

Assuming that the .php and .aspx extensions have been hidden from the URLs, are there any clues in the HTML that might suggest the site is coded in either php or asp?

Cheers.

Answer 1

A lot of times ASP.Net websites will have ViewState, so you can look for that attribute in a tag on a page. Other than that, there is no real distinguishable differences (as far as I know) that are noticeable strictly from looking at the page and it's HTML. Granted, there are probably things that are ASP.Net specific - like certain controls such as some third party controls.

Answer 2

Look for a form submission page and check what extension the action is submitting to.

It doesn't catch a lot of MVC frameworks, but it does provide a few quick wins.

Answer 3

You can take a look at the HTTP headers the server is sending as part of its response, with a firefox extension like LiveHTTPHeaders or firebug.

Sometimes (not always), this information is given in one of those.

For instance, on SO, you only have :

Server: Microsoft-IIS/7.0

On microsoft.com, you have more informations :

Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET

On wikipedia :

Server: Apache
X-Powered-By: PHP/5.2.4-2ubuntu5wm1

And, on sun.com :

Server: Sun-Java-System-Web-Server/7.0

So, depends on the configuration of the server... But it sometimes allow you to get the information you are looking for ;-)

If those headers (and/or others) don't get you the information you need... Having a look at the source of the HTML page, or at the name of some cookies can help ; but generally much harder to say :-(

For cookies, for instance :

• in PHP, the session id is often stored in a cookie calle PHPSESSID (that's it's default name)
• in JAVA, I believe there is sometimes a cookie called JSESSIONID

Yet another way is if you can get the server to display a page that shouldn't be displayed to "normal users" -- like an error page : developpers don't always think to hide informations on these ones ; and some webservers include the name of the server at the bottom of technical pages ^^

Or, as a last possibility, you can try "dumb pages" like phpinfo.php, test.php, info.php, and so on : sometimes, developpers forget to remove those -- but it's really an idea that you'll use as a last hope, I suppose ^^

Answer 4

If the HTML is a mess then you have 90% chance it's been developed in .NET.

Answer 5

Look at session tokens. PHP by default uses a PHPSESSID cookie name.

Answer 6

Examine HTML, JavaScripts, headers and everything you have carefully and you may get some clues. For example, in StackOverflow HTML you can find code like this

http://ads.stackoverflow.com/a.aspx?ZoneID=0&BannerID=323&AdvertiserID=5&CampaignID=194&Task=Click&SiteID=1

so, it is asp.net (or at least advertisment engine use ASP.NET) :)

However, if author of the web site will be very carefull, he can clean up all clues (and probably even give you wrong clues, like assigning *.PHP files to be processed by aspnet_iisapi filter. Why not ?

When you se controls names like ctl00_Blogs_usercontrols_public_community_latestblogposts_ascx1_repeaterBlogPosts_ctl03_hlTitle this is for sure ASP.NET :)

Also, look at JavaScript function/file/variable names. Sometimes developers use 3rd party products and tools. If you see vendor or product name is a part of javascript name you can search what is it and probably when you define a vendor, you will define a developer platform. For example code like this

Sys.Application.add_init(function() {
    $create(Telerik.Web.UI.RadContextMenu ...

means that Telerik control is used and Telerik produces only .NET controls.

Answer 7

Check the website out @ BuiltWith

Answer 8

There are clues you can look for as many have pointed out, but I don't believe any of it is really that reliable. If someone really wanted to make you think their PHP site is developed in ASP.NET or vice versa, they probably could.

Keep in mind also that the two aren't mutually exclusive. You could build a single site from both technologies.

Answer 9

All the answers are correct, but at the end it is still possible that you can't determine with what a website is built except by asking the developer directly.

Answer 10

One possibility to determine whether PHP is installed on the server is described at http://shiflett.org/blog/2006/feb/php-easter-eggs

Try http://yoursite/?=PHPE9568F36-D428-11d2-A769-00AA001ACF42

This can also be disabled by server conf and some people do.

Answer 11

Send an e-mail to the site administrator saying you really like their site and were wondering what technologies were used to crerate it. Some people are very helpful and will reply (some, of course, aren't or are forbidden by corporate policy).

Answer 12

You can use a site like : http://www.examineurl.com

You give the URL of the server and it can show you information of the server !