What tactics can I use to prevent users from discovering what language a website is written in?

Question

So, if you are writing a website using Java and JSP's and didn't want users to know what language you written it in. What techniques would you use?

Answer 1

The only thing I would do is some how pass in the requests to pages without the extensions (jsp, aspx, asp, etc). This can be done by manually parsing the request url. Also, reconfiguring your server to hide its details about what it is.

Answer 2

If you are using some sort of framework, like Struts2, you'll have an extension (*.action, or whatever you choose) mapped to the dispatcher servlet. The dispatcher "forwards" the request to the JSP, which is in the WEB-INF directory. Users only see the URL that was directed to the servlet, and get back HTML. They can't tell what the template language was. Since you can choose whatever you like for the servlet mapping, you could make something up, or even misdirect them with something like ".php" or ".asp".

Of course, you might have some JSPs right in the web app directory, rather than in WEB-INF. You can give these a different extension, and tell the container to process them as JSPs by creating a <jsp-property-group> with a url-pattern element that specifies the fake extension in web.xml.

You'll also need to examine your container's documentation to determine how to hide any server version information that might be sent. Another thing to explore is how to change the session cookie name to something other than "jsessionid". That's a bit of a giveaway, but it's part of the Servlet specification, and some containers don't support changing it.

Answer 3

Along with other answers here, you'll want to make sure you're handling your application errors correctly. If you let an Exception out and the web container handles it, it'll be pretty obvious what you're using.

Answer 4

1) Make up your own file extension and configure your server to map that to your handler of choice. e.g. Remap .whee to invoke the ASP.NET handler or PHP handler.

2) Make sure that whatever handler you are using doesn't put headers in to indicate what it is, like most do. If it does, configure it not to, or else put something in front of it in the stack to remove those headers before transmitting.

Answer 5

You'll also want to inspect the HTTP response headers that your app sends back. Often times it's trivial to find the technology powering an app in the response headers.

Answer 6

In the Apache configuration files, the following line causes it to recognize .php as a PHP script and execute it as such:

AddHandler php5-script .php

Change it to .asp and Apache will recognize .asp files as PHP scripts. Change it to, say, .blarg, and Apache will recognize .blarg files as PHP scripts.