Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

For example, stackexchange.com, without asking the site owner or Google their information about developing the website, is this possible to know what language is used in the back end?

Seems, the website don't have .extension bar, for example .php that can indicated which is developed in PHP, but without the extension, how can I know that?

share|improve this question
40  
It should be noted that the extension of a requested file by URL need not map directly to a file on the filesystem. One can quite easily map an extension like .php to a CGI-Script written in C or a Servlet written in Java. –  maple_shaft Jun 4 '12 at 11:12
1  
@Jeroen Community Wiki is not supposed to be used as you propose. I know it was commonly abused as such in the past, but let's try to forget about that... –  Yannis Rizos Jun 4 '12 at 11:47
6  
Strictly speaking it is impossible. Most any language can completely emulate another language - including any "tell tale" signs you may be looking for. –  emory Jun 4 '12 at 13:13
2  
From my naive perspective, I can't see an application of this information. What would you do with this information? –  tehnyit Jun 4 '12 at 13:29
4  
Also, finding sites vulnerable to exploits. –  Erik Reppen Jun 4 '12 at 14:46
show 5 more comments

9 Answers 9

up vote 69 down vote accepted

There are indicators. Some are easier to find, others are harder.

  • file extensions: .php indicates that the site is written in PHP, .asp indicates classic ASP, .aspx indicates ASP.NET, .jsp indicates Java JSPs, ...
  • cookie names: JSESSIONID is a widely used cookie name in Java servers
  • headers: some systems add HTTP headers to their responses
  • specific HTML content:
    • patterns such as lots of div-wrappers with a consistent class-naming scheme as used by CMSes like Drupal.
    • comments in the HTML or meta tags in the head directly/indirectly indicating tool usage
  • Default error messages or error page design (e.g. pinging a fake URL to see their 404)
  • Sometimes comment tags are placed in the page for versioning purposes which provide a clue *...

But all of those can be remove/changed/faked. Some are easier to change than others, but none are 100% reliable.

There are various reasons to change those indicators:

  • You change the underlying technology but don't want to change your URLs
  • You want to give as little information about your technology as possible
  • (related to previous) You'd rather not be the first stop for the script kiddie bus when known platform-wide vulnerabilities are discovered/publicized
  • You want to seem "in" (even 'though that currently means having extension-less REST-style URLs).
  • ...
share|improve this answer
7  
The PHP equivalent to JSESSIONID is PHPSESSID. –  Yannis Rizos Jun 4 '12 at 10:49
4  
There are numerous tools out there doing the analysis, for example wappalyzer.com –  Pumbaa80 Jun 4 '12 at 11:37
1  
Just tested wappalyzer on a Django site - the only thing it detected was JQuery and Google Analytics. And PHP site with in-house framework, where it detected nothing at all. –  vartec Jun 4 '12 at 13:27
16  
+1 for "all of those can be faked" –  FrustratedWithFormsDesigner Jun 4 '12 at 14:03
1  
@OP, I would definitely target session cookies as the first way to try and sort out what's in use in an automated system. That's one thing the less obvious frameworks are likely to consistently show but as said, nothing's 100% reliable. –  Erik Reppen Jun 4 '12 at 14:28
show 4 more comments

Well, there is the humans.txt file that a developer can put up on the domain that gives some information about the site development, maybe who worked on it and what standards or tools were used. If they want you to know about those kinds of information, they could/should put it there. However, just like anything else this is optional so it can't guarantee to inform you either. Check out humans.text

share|improve this answer
    
+1 for humans.txt –  Wyatt Barnett Jun 19 '12 at 11:53
add comment

No, it could rather hard if not impossible if the webmaster doesn't want to disclose. There are some characteristics of few frameworks, but they can be hidden.

  • file extensions: there is no real reason to use standard ones, and most modern MVCs use URL routing anyway. So unless site has been around for some time, you're probably not going to see any (eg. stackexchange does't use .aspx extension);

  • session IDs: for example PHPSESSID is default for PHP, but can be easily overridden;

  • headers with web server and scripting language versions: can be turned off or even faked.

Stuff that's harder to hide:

  • PHP handles multiple values for same query string variable by appending [] to the name, thus you'd see something like: ...?var[]=1&var[]=3&.... AFAIK, it's the only web framework which handles it that way.
share|improve this answer
    
Are you calling PHP a web framework? It's more a Turing-complete language that can be used in doing more than web-stuff (although it's usually not used as such) –  faif Apr 14 at 11:01
    
@faif: in any other language parsing query string is part of web framework. Even Rasmus Lerdorf considers PHP to be a web framework. You know better then the author? –  vartec Apr 14 at 12:17
    
That's what he had in mind initially, but I think that PHP can do today much more. For correctness, I wouldn't call PHP a web framework. In that case what CakePHP, codeigniter, etc. are? Web frameworks of the web framework? :) –  faif Apr 14 at 12:27
    
I don't get your point. PHP is a language which has core functionality of a web framework embedded in the language itself. Deal with it. –  vartec Apr 14 at 12:55
add comment

In short: It is possible to hide what language you are using on the back-end. Trivial example: consider a "Hello World" page; it'd be extremely difficult to figure out what framework / language was being used on the back-end (assuming the basic stuff like session cookies are manually set or not in use).

However, the point of frameworks is to save you having to re-implement functionality, and to make you work in a standardised way. Almost all frameworks have their specific little tell-tales which will give them away, if you look close enough. As others have pointed out, it is possible to try to hide these, by using configuration or re-implementing various standard features. Nevertheless, I'd argue that for large sites, it'd be extremely difficult to completely hide everything, and even if you accomplished that, you'd be using very little of your framework.

In summary, I'd say it's almost always possible to get a very good idea of what's being used underneath (with some careful examination and prodding). Hiding the framework used is possible, but quickly becomes infeasible for large sites.

The previous answers have some good examples of various tell-tales that frameworks and languages have. I'd like to add that various view engines have specific whitespace-related behaviour which can be used to identify them. The Razor engine used in MVC3+ has some fairly specific quirks which could be used to identify it, or at least, narrow down the list of suspects (again, you can side-step it, but then, are you using it?).

share|improve this answer
add comment

I don't know if this specifically answer your question but there is a tool that was really helpful to me: Wappalyzer. It is a Firefox/Chrome extension that uncovers the technologies used on websites. It detects content management systems, web servers, JavaScript frameworks, analytics tools and many others. I know is not precisely what you are looking for but it give you a very close idea of what a site use. This is what it shows for programmers.stackexchange.com

Wappalyzer

share|improve this answer
    
Ha ha, I visited my blog and it says Apache 2/PHP 5.5.9, but I'm pretty sure it's roll-your-own ASP.NET MVC blog, because I made it. Because for trolling reasons I've changed 'X-Powered-By: ASP.NET' response header to PHP. –  Lars Apr 14 at 6:52
add comment

It is possible to write a site in such a way, that no clues about the server technology will be visible to the client.

However, when someone uses some frameworks, such as IceFaces for Java, it is practically impossible do do because you'll see something like that in your requests:

ice.submit.partial=true&ice.session=c4f4jxT36tM_38848488&ice.view=3&ice.focus=&rand=0.322803445

Much of other frameworks have their characteristic stamps in either page body or requests/responses. Find them, google and you'll have an answer.

However, in each language, if you choose to create HTML from scratch (in Java world an example would be velocity templates) or choose pure AJAX way, where server returns/accepts only JSON messages, and client is entirely in JavaScript - a hard way, until you cause uncatched exception that reveals the technology under.

share|improve this answer
add comment

On sites which uses full-blown framework or CMS, sometimes you can try querying the admin page, you'll be presented with a login box and identify what framework it came from because most people don't reskin the admin template. For instance if your site is example.com, try going to example.com/admin/ or example.com/wp-admin/ (wordpress).

share|improve this answer
add comment

It is possible to determine if a site was built with Asp.Net web forms. From the source code you'll see stuffs like __doPostBack(), __EVENTTARGET, __EVENTARGUMENT, ctl00_

Another way is looking at the naming conventions of controls in the source. That is if the developer followed the convention. Like in asp.Net, names like userNameLabel, userNameTextBox (sometimes txtUserName, lblUserName) is common. Jsp, php developers should have their own conventions too.

In general, it is not easy to determine

share|improve this answer
add comment

No it is not possible to find language used in the websites by viewing the source code of the web page and search the existence of languages. because of usage of more than one languages for creation of website to provide high security

share|improve this answer
add comment

protected by gnat Apr 14 at 7:45

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.